Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Nuclei sends requests described in YAML templates and matches responses against conditions defined in the same template. Templates cover HTTP, DNS, TCP, SSL, headless browser, code and file checks, so the same engine can test web applications, network services and cloud configurations.
The public nuclei-templates repository, maintained by ProjectDiscovery and the community, adds checks for newly disclosed CVEs quickly. Teams also write private templates for their own applications and run Nuclei in CI or across large asset inventories.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
12 published advisories for Nuclei in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.
GHSA-vxg7-f2jj-jmqmCVE-2026-76819high2026-07-16
Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
GHSA-jpf4-98qj-qr67CVE-2026-76802medium2026-07-16
Arbitrary Command Execution via DAST Code Signature Bypass
GHSA-xhmx-w2j4-rw3qCVE-2026-76803medium2026-07-16
Local File Read via MySQL Client Sandbox Bypass
GHSA-qgw5-7j4f-fg97CVE-2026-76804medium2026-07-16
Local File Read via Workflow File-Protocol Gate Bypass
GHSA-jpvm-9frm-hjcqCVE-2026-76805medium2026-07-16
Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
GHSA-jm34-66cf-qpvrCVE-2026-41282moderate2026-04-22
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
GHSA-29rg-wmcw-hpf4CVE-2026-41646medium2026-04-18
Local File Read via require() Module Loader Bypass
GHSA-jm34-66cf-qpvrCVE-2026-41645medium2026-04-18
Environment variable disclosure via Response-Derived DSL Expressions
GHSA-7h5p-mmpp-hgmmCVE-2024-43405high2024-09-04
Nuclei Template Signature Verification Bypass
GHSA-c3q9-c27p-cw9hCVE-2024-40641high2024-07-17
Unsigned code template execution through workflows in projectdiscovery/nuclei
GHSA-w5wx-6g2r-r78qCVE-2024-27920high2024-03-15
Unsigned code template execution through workflows in projectdiscovery/nuclei
GHSA-2xx4-jj5v-6mffCVE-2023-37896medium2023-08-04
Nuclei < 2.9.9 - Sandbox restriction bypass
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
Network vulnerability scanner (Greenbone Community Edition)
Scanner engine of the Greenbone Community Edition, running network vulnerability tests from the Greenbone community feed against hosts and services.
Vulnerability management and DevSecOps findings platform
Web platform that imports findings from many security scanners, deduplicates them and tracks remediation across products and engagements.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Penetration testing framework
Rapid7's open-source framework for developing, testing and running exploit modules and auxiliary checks in authorised security assessments.
