Fedora Nuclei Vulnerabilities: Cross-site Scripting and Information Disclosure Risks

Fedora has released security updates addressing critical vulnerabilities in the Nuclei scanner. CVE-2026-5160, published on April 15, 2026, involves cross-site scripting due to improper URL validation, affecting multiple versions of Nuclei. Additionally, CVE-2026-41646, published on May 8, 2026, allows information disclosure via JavaScript template local file access bypass. Users of Fedora 43 and 44 are advised to apply the updates to mitigate these risks. The vulnerabilities could lead to broader security issues if exploited, particularly in environments with overly broad permissions. The updates can be installed using the 'dnf' package manager. The vulnerabilities highlight the importance of maintaining least privilege access in Linux systems.

Key Points: • CVE-2026-5160 and CVE-2026-41646 pose significant risks to Fedora users. • Cross-site scripting and information disclosure vulnerabilities are present in Nuclei. • Immediate updates are recommended to mitigate potential exploitation.