Release Radar

What's Changed

🎉 New Features

• Added shodanct passive source by @dogancanbakir in https://github.com/projectdiscovery/subfinder/pull/1796
• Added Option -vR, -virustotal-res for VirusTotal source by @Bundy01 in https://github.com/projectdiscovery/subfinder/pull/1719
• Added machine-readable source listing with -ls -oJ by @Gerijacki in https://github.com/projectdiscovery/subfinder/pull/1812

🐞 Bug Fixes

• Fixed source leaks by @Mzack9999 in https://github.com/projectdiscovery/subfinder/pull/1801
• Fixed drain source channels on cancel so source goroutines exit instead of leaking on a blocked send by @Mzack9999 in https://github.com/projectdiscovery/subfinder/pull/1799
• Fixed crtsh's query by dropping unused certificate metadata from SQL query by @ChrisJr404 i...

What's Changed

🎉 New Features

• Added Context field to Options for external lifecycle control by @idanavishai in https://github.com/projectdiscovery/katana/pull/1593
• Added secrets extractor to knowledgebase by @dogancanbakir in https://github.com/projectdiscovery/katana/pull/1667
• Added endpoints extractor to knowledgebase by @dogancanbakir in https://github.com/projectdiscovery/katana/pull/1669
• Added callbacks to headless engine by @evanrolfe in https://github.com/projectdiscovery/katana/pull/1662
• Added content similarity detection / deduplication by @geeknik in https://github.com/projectdiscovery/katana/pull/915

🐞 Bug Fixes

• Fixed require label boundary for rdn scope to block look-alike domains by @Mubashirrrr in https://github.com/projectdiscovery/katana...

Changelog

• 1a4446f Add cis benchmark for rh-1.9 (#2103)
• 1699971 Added CIS benchmarks for rke2-cis-1.9 (#2099)
• cd5ce79 build(deps): bump alpine from 3.23.4 to 3.24.1 (#2117)
• 73ef8ea build(deps): bump github.com/aws/aws-sdk-go-v2/service/securityhub (#2090)
• 7c04cc6 build(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 (#2068)
• 8c01483 build(deps): bump golang from 1.26.3 to 1.26.4 (#2110)
• e943fe3 build(deps): bump golang from 1.26.4 to 1.26.5 (#2121)
• 1a2d5a7 build(deps): bump golang.org/x/net from 0.47.0 to 0.55.0 (#2118)
• f5efd65 build(deps): bump k8s.io/client-go from 0.35.2 to 0.36.3 (#2088)
• a73ce37 ci: pin GitHub Actions to immutable commit hashes (#2106)
• 2dc17e7 fix(rke2-cis-1.8): align CIS checks with RKE2 behavior (#2123)
• 0241de8 fix: CVE-2026-46600 (#...

2.0.4

August 04, 2026

BREAKING CHANGES:

• containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.

SECURITY:

• acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.
• identity/scim (enterprise): The identity/entity/merge endpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM b...

Bug Fix

• terraform: handle null container_properties in aws_batch_job_def… - #7636

The Nikto 2.6.1 release focuses on scan consistency, safer internals, and a few behavior changes.

SQL Direct Reporting

The new SQL Direct plugin will insert findings directly into a MySQL or PostgreSQL database via the -F sqld output format option. See the wiki docs for setup info.

TLS Keep-Alives

TLS connections now use keep-alives for session reuse. This results in a significant scan speed increase (~18%). Can be disabled if a server misbehaves with -nosslkeepalive.

User-Agent handling

Nikto no longer rotates User-Agents on every request by default. It now uses a static Chrome UA for more stable responses. This reverts to behavior from 2.5.0.

• **`-user...

• Document the YR_RE_SCAN_LIMIT regular expression scan limit (#2223).
• BUGFIX: Bound rule table index in OP_PUSH_RULE and OP_INIT_RULE (#2230).
• BUGFIX: Bound tilde stream row-count read in dotnet module (#2224).
• BUGFIX: Bound repeat stack depth in _yr_re_fiber_sync (#2229).
• BUGFIX: Fix memory leak in yr_rules_load_stream (e13acd3d).
• BUGFIX: Add missing yr_le16toh byte-swapping in pe module (a2ff0db0).
• BUGFIX: Validate summary counts in yr_rules_from_arena (#2222).
• BUGFIX: Cast e_lfanew to int32_t before sign check in pe_get_header (#2228).
• BUGFIX: Bound export name count against 32-bit overflow in pe_parse_exports (#2227).
• BUGFIX: Null-terminate authenticode digest/thumbprint hex buffers in pe module (#2221).
• BUGFIX: Fix string memo...