nuclei
v3.11.1Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
- Maintenance
- Active448 commits in 3 months · bus factor 3
- License
- MITPermissive · OSI-approved
- Security
- 11 advisories4 high, 7 medium · Scorecard 6.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
32.9k stars · 4k forks · 106 open issues · last release 3 months ago · data checked 59 minutes ago
Security advisories
All advisories on GitHubThe 11 most recent advisories published by the maintainers: 4 high, 7 medium. Check the patched version against the one you run.
- mediumCVE-2026-76805Jul 16, 2026Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
- Affected
- >= 3.0.0, < 3.10.0
- Patched in
- 3.10.0
- mediumCVE-2026-76804Jul 16, 2026Local File Read via Workflow File-Protocol Gate Bypass
- Affected
- >= 3.0.0, < 3.10.0
- Patched in
- 3.10.0
- mediumCVE-2026-76803Jul 16, 2026Local File Read via MySQL Client Sandbox Bypass
- Affected
- >= 3.0.0, < 3.10.0
- Patched in
- 3.10.0
- mediumCVE-2026-76802Jul 16, 2026Arbitrary Command Execution via DAST Code Signature Bypass
- Affected
- >= 3.0.0, < 3.10.0
- Patched in
- 3.10.0
- highCVE-2026-76819Jul 16, 2026Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
- Affected
- >= 3.0.0, < 3.10.0
- Patched in
- 3.10.0
- mediumCVE-2026-41645Apr 18, 2026Environment variable disclosure via Response-Derived DSL Expressions
- Affected
- >= 3.0.0, < 3.8.0
- Patched in
- 3.8.0
- mediumCVE-2026-41646Apr 18, 2026Local File Read via require() Module Loader Bypass
- Affected
- >= 3.0.0, < 3.8.0
- Patched in
- 3.8.0
- highCVE-2024-43405Sep 4, 2024Nuclei Template Signature Verification Bypass
- Affected
- > 3.0.0
- Patched in
- 3.3.2
- highCVE-2024-40641Jul 17, 2024Unsigned code template execution through workflows in projectdiscovery/nuclei
- Affected
- > 3.0.0
- Patched in
- 3.3.0
- highCVE-2024-27920Mar 15, 2024Unsigned code template execution through workflows in projectdiscovery/nuclei
- Affected
- > 3.0.0
- Patched in
- 3.2.0
- mediumCVE-2023-37896Aug 4, 2023Nuclei < 2.9.9 - Sandbox restriction bypass
- Affected
- < 2.9.9
- Patched in
- 2.9.9