projectdiscovery nuclei vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20243
3. 20268

Newest CVEs

• CVE-2026-76805

  Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

  projectdiscovery · nuclei

  Medium5.3
• CVE-2026-76802

  Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

  projectdiscovery · nuclei

  Medium4.7
• CVE-2026-76804

  Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

  projectdiscovery · nuclei

  Medium5.5
• CVE-2026-76803

  Nuclei: Local File Read via MySQL Client Sandbox Bypass

  projectdiscovery · nuclei

  Medium5.3
• CVE-2026-92718

  Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

  projectdiscovery · nuclei

  High7.0
• CVE-2026-41645

  Nuclei: Environment variable disclosure via Response-Derived DSL Expressions

  projectdiscovery · nuclei

  Medium5.3
• CVE-2026-41646

  Nuclei: Local File Read via require() Module Loader Bypass

  projectdiscovery · nuclei

  Medium5.5
• CVE-2026-41282

  ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not…

  ProjectDiscovery · Nuclei

  Medium4.0
• CVE-2024-43405

  Nuclei Template Signature Verification Bypass

  projectdiscovery · nuclei

  High7.4
• CVE-2024-40641

  Unsigned code template execution through workflows in projectdiscovery/nuclei

  projectdiscovery · nuclei

  High7.4