projectdiscovery/nuclei

View on GitHub

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Stars: 31.3k
Forks: 3.9k
Open beginner issues: 0
Indexed issues: 62
Avg merge: 1d 7h
Merged PRs (30d): 25

Dominant language: Go
License: MIT
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

62 open issues indexed

smb-anonymous-access can never match, and the obvious fix makes it a false positive on any guest-mapping server Open

projectdiscovery/nuclei#7752 · 1 assignee · Opened Sep 17, 2026
[BUG] Invalid XPath extractor expressions compile successfully and are silently skipped Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

projectdiscovery/nuclei#7750 · Opened Sep 16, 2026
[BUG] zstd response decoder is never closed: goroutine/memory leak on large `Content-Encoding: zstd` responses Open

Type: Bug

projectdiscovery/nuclei#7749 · 2 comments · 1 assignee · Opened Sep 16, 2026
[BUG] json-export silently drops findings: dedupe hash omits port Open

Type: Bug

projectdiscovery/nuclei#7745 · 1 assignee · Opened Sep 15, 2026
[FEATURE] interpolate variables in llm matcher/extractor prompts Open

Type: Enhancement

projectdiscovery/nuclei#7744 · 1 reaction · 1 assignee · Opened Sep 15, 2026
[FEATURE] llm matchers and extractors on non-http protocols Open

Type: Enhancement

projectdiscovery/nuclei#7743 · 1 assignee · Opened Sep 15, 2026
[FEATURE] llm matcher: inputs for multi-response semantic diff Open

Type: Enhancement

projectdiscovery/nuclei#7742 · 1 assignee · Opened Sep 15, 2026
Headless templates download full Chromium on Linux Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

projectdiscovery/nuclei#7738 · Opened Sep 14, 2026
[FEATURE] semantic matchers: type: llm matchers and extractors Open

Type: Enhancement

projectdiscovery/nuclei#7733 · 2 comments · 1 reaction · 1 assignee · Opened Sep 11, 2026
[BUG] SDK: .nuclei-ignore is read before the installer creates it, so the first engine runs with an empty deny-list Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

projectdiscovery/nuclei#7704 · 2 comments · Opened Sep 4, 2026
[BUG] ThreadSafeNucleiEngine: live heap scales with concurrent ExecuteNucleiWithOptsCtx calls (compiled template store rebuilt per call, DoNotCache) Open

projectdiscovery/nuclei#7686 · 1 comment · 1 assignee · Opened Sep 1, 2026
[BUG] Nuclei template signature bypass: mtime-only metadata cache runs unsigned code templates Open

Type: Bug

projectdiscovery/nuclei#7663 · 2 comments · 1 assignee · Opened Aug 17, 2026
[BUG] Fatal runtime fault (access violation 0xc0000005) crashes nuclei daily during concurrent scans on Windows Server 2025 Open

Type: Bug

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#7630 · 1 comment · Opened Jul 31, 2026
Evaluate DSL helper expressions in -H header values per request Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

projectdiscovery/nuclei#7617 · 1 comment · Opened Jul 27, 2026
[BUG] regex extractor group beyond the pattern capture count silently extracts nothing Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

projectdiscovery/nuclei#7611 · Opened Jul 26, 2026
Track exact-basename matching for known template configuration files Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

projectdiscovery/nuclei#7610 · Opened Jul 26, 2026
Add katana input Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

projectdiscovery/nuclei#7548 · Opened Jul 15, 2026
[BUG] httpx Request statistics Open

Type: Bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

projectdiscovery/nuclei#7543 · Opened Jul 14, 2026
code/JS protocols can reach host filesystem and network without confinement Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#7526 · Opened Jul 5, 2026
confidence scoring Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

projectdiscovery/nuclei#7505 · Opened Jun 25, 2026
Add local HTTP(S) callback listener mode for offline/internal OAST detection Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

projectdiscovery/nuclei#7437 · 2 comments · Opened Jun 1, 2026
[RFC] Raw HTTP Response Body Access for Compressed Responses Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

projectdiscovery/nuclei#7387 · 4 comments · Opened May 10, 2026
[RFC] Template Target Resolution Consolidation Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

projectdiscovery/nuclei#7386 · 2 comments · Opened May 8, 2026
[Feature Request] Add a flag (e.g., -strict-probe) to stop scanning if internal httpx probe fails (No Fallback) Open

Type: Enhancement

projectdiscovery/nuclei#6651 · 2 assignees · Opened Dec 3, 2025
JS function for advanced auth with options Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#6447 · 3 comments · Opened Sep 1, 2025
[MAINTENANCE] Replace `sonic` with `encoding/json/v2` Open

Type: Enhancement

projectdiscovery/nuclei#6331 · 1 assignee · Opened Jul 17, 2025
[FEATURE] Disable automatic response decompression Open

Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

projectdiscovery/nuclei#6304 · 13 comments · Opened Jul 6, 2025
[TEMPLATE REQUEST] Wappalyzer based tech detection using wappalyzergo Open

Type: Enhancement

projectdiscovery/nuclei#6336 · 1 assignee · Opened Jun 19, 2025
[FEATURE] Run FIle protocol over smb network Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

projectdiscovery/nuclei#6142 · 2 comments · Opened Apr 3, 2025
Heuristics based change analyzer Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 15/100

projectdiscovery/nuclei#5839 · 2 comments · Opened Nov 19, 2024
[FEATURE] graphql fuzzing support with dast templates Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

projectdiscovery/nuclei#5717 · 1 comment · Opened Oct 10, 2024
global variables `{{RDN}}`, `{{FQDN}}` input support with `-iserver` option Open

Status: Stale Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

projectdiscovery/nuclei#5711 · 5 comments · Opened Oct 9, 2024
[FEATURE] Add ServiceNow issue tracker support for reporting Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#5649 · Opened Sep 19, 2024
[FEATURE] PDCP Login on first run Open

Type: Enhancement

projectdiscovery/nuclei#5624 · 1 comment · 1 assignee · Opened Sep 10, 2024
[FEATURE] pdcp template sync support Open

Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

projectdiscovery/nuclei#5612 · Opened Sep 6, 2024
[FEATURE] Rolling template release update support Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

projectdiscovery/nuclei#5608 · 2 comments · Opened Sep 5, 2024
[FEATURE] Add Integrations or providers for Secrets File Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#5566 · Opened Aug 25, 2024
[FEATURE] Support Tamper Scripts via Javascript using passive templates Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#5565 · 1 comment · Opened Aug 25, 2024
Inconvenient path parameters fuzzing Open

DAST Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

projectdiscovery/nuclei#5495 · 1 reaction · Opened Aug 6, 2024
Feature Request: Support for HTTP 2+ single-packet attacks Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#5439 · Opened Jul 23, 2024
Add `file` helper function to help import static payloads from files Open

Type: Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 58/100

projectdiscovery/nuclei#5402 · 5 comments · Opened Jul 13, 2024
Support Multiple events generation using operators Open

Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

projectdiscovery/nuclei#5353 · 2 comments · Opened Jul 2, 2024
introduce 'service' field/input in network/javascript templates Open

Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

projectdiscovery/nuclei#5269 · Opened Jun 6, 2024
Add more OpenAPI security schemes like oauth2 etc Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

projectdiscovery/nuclei#5069 · 1 reaction · Opened Apr 18, 2024
Per template customisation of interactsh timers/timeouts Open

Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 42/100

projectdiscovery/nuclei#5061 · 1 reaction · Opened Apr 17, 2024
Support Concurrency when executing conditional requests with payloads Open

Type: Discussion Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#5015 · 1 comment · Opened Apr 8, 2024
Implement unit tests for nuclei templates validation Open

Type: Enhancement

projectdiscovery/nuclei#4996 · 2 comments · 1 assignee · Opened Apr 5, 2024
url deduping for fuzzing Open

DAST Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 15/100

projectdiscovery/nuclei#4962 · Opened Mar 29, 2024
Improve Nuclei YAML template JsonSchema Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

projectdiscovery/nuclei#4950 · Opened Mar 27, 2024
Adds support for input adapted to different goals Open

Community ✅ Type: Enhancement workflows

Difficulty 5/5 Over a week Newbie friendliness 35/100

projectdiscovery/nuclei#4934 · 2 comments · Opened Mar 24, 2024

projectdiscovery/nuclei

Get new issues in your inbox