CVE•Published 2026-06-03•Modified 2026-06-05•0 articles on news•6 live references•NVD data
CVE-2026-8888Securly · Securly
Vulnerability data via NVD (ingested)
CVSS v3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS percentile
5
Exploit Prediction Scoring System · top 95% of all CVEs
Weaknesses (CWE)
Description
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.
Timeline
Published 2026-06-03
Modified 2026-06-05
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag0 hosts
vuln:CVE-2026-8888Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product + version
product:"Securly Securly" version:"3.0.7"Version-pinned fingerprint from NVD's first vulnerable CPE.
Shodan · banner/body mention
http.html:"Securly"HTTP body or banner mentions "Securly" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2026-8888Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2026-8888Censys host search filtered to this CVE id.
grep.app
CVE-2026-8888Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2026-8888GitHub code search for direct mentions.
Google dork
"CVE-2026-8888" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (8)
CVE-2026-88888 repos
beenuar/AiSOCPython
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
0xSteph/pentest-aiPython
Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.
OpenOSINT/OpenOSINTPython
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 16 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
grisuno/LazyOwnPython
LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Window…
7WaySecurity/ai_osintunknown
🤖 Curated AI OSINT resources — Google dorks, Shodan queries, GitHub dorks, and techniques to discover exposed LLM endpoints, leaked AI API keys, misconfigured vector databases, an…
3sk1nt4n/arguswatch-aiPython
AI-Agentic Threat Intelligence - 39 collectors, 7 AI agents, 3-link proof chain, D1-D5 exposure scoring
culpur/cstrikeTypeScript
CStrike v2.6 — Offensive Security Platform. 35+ tools, 9-container Docker stack, self-update system, parallel port scanning, VPN kill-switch. Dual-arch (amd64/aarch64) VM distribut…
LuemmelSec/ToolShellPython
We haven't classified any articles referencing CVE-2026-8888 yet. The external references above still apply.