projectdiscovery/nuclei-templates

Adopt this if you already use or plan to use the nuclei scanner and want a broad, community-maintained set of checks rather than writing every test yourself. It is a template corpus, not a scanner, so its value depends heavily on the engine and on how you pick subsets.

The problem

A security tester who wants to check an application for known flaws normally starts from a blank template file: read the advisory, work out the request shape, encode the match condition, and repeat for every vulnerability. The friction is in that authoring loop, not in running a scanner once a check exists. This repository changes that step by supplying thousands of pre-written templates that the nuclei engine can execute directly. The result is that a tester can point the engine at a target and get findings for a large catalog of known issues without authoring each probe.

What's different

This is the official template collection for projectdiscovery's nuclei engine, and the README says templates are the core of the scanner. The catalog is large and organized by tag, severity, author and directory: the top-ten table lists 6,468 vuln templates, 3,587 cve, 3,265 discovery, 1,269 xss and 1,261 wordpress, among others, spread across 873 directories and 11,997 files. The spread across HTTP, cloud, file, network, code, DAST and workflow directories matches the engine's multi-protocol design.

A useful differentiator is the KEV mapping. The README reports 454 templates tied to the CISA Known Exploited Vulnerabilities catalog, 1,449 to VulnCheck KEV, 407 overlapping, and 1,496 unique KEV templates, selectable with a tag. That gives a practical way to narrow a run to vulnerabilities reported as exploited in the wild instead of scanning everything.

The trade-off is that this is a shared, community-curated corpus. Breadth comes with uneven depth and freshness across entries, and running large template sets produces many info-severity discoveries (4,353 of them) alongside real findings, so result triage is part of the workflow. The documentation covers building custom templates but the supplied excerpt does not describe per-template maintenance or false-positive handling.

Who should try it

Good fit: pentesters, bug-bounty hunters and security teams already running nuclei who want immediate coverage of CVEs, exposures and panel detection, and who can filter by tags or severity to keep scans focused. The KEV tags are especially relevant if you need to prioritize actively exploited issues.

Poor fit: someone without the nuclei engine, since these files do nothing alone; or a team that wants a small, audited, hand-picked check set and cannot review thousands of community templates. If you need custom logic for an internal app, you will be authoring templates anyway and this repo mainly serves as reference.

Requirements and limitations

You need the nuclei scanner from the sibling repository; templates are inert without it. The corpus is huge, so default all-template scans are slow and noisy and you should expect to select by tag, severity or directory. Coverage of individual CVEs depends on contributors, so a missing check is not evidence the vulnerability is absent. Contributions go through pull requests or issue templates, and the FAQ is the place to check before assuming behavior.

HotRepo's take

HotRepo recorded 13,215 stars on 2026-10-24 (+17) and 13,217 on 2026-10-25 (+18), across a project created in 2020. That is only two dated observations, so trend persistence cannot be judged from the supplied signals. Before relying on it, check whether the specific CVE or product you care about has a maintained template rather than assuming catalog size equals coverage.