Nuclei
A large community collection of YAML scan templates for the nuclei scanner to find security weaknesses.projectdiscovery/nuclei-templates
- Stars
- 13.3k
- Forks
- 3.7k
- Licence
- MIT
- Language
- JavaScript
- Last update
- 4 days ago
- Type
- Dev tool
What it is
This repository holds a large set of community-contributed and team-written templates used by the nuclei scanner, a separate tool from the same project. Each template describes a check for a known vulnerability, misconfiguration, or exposed panel, and nuclei runs those checks against web applications and other targets. The README says it is intended for finding security vulnerabilities in applications and is widely used for security testing.
- Run nuclei with the kev,vkev tags to check targets for actively exploited vulnerabilities
- Scan a web application for exposed admin panels or WordPress plugin issues using tag filters
- Browse templates by severity, tag, or directory to build a focused scan
- Write your own custom template by using the existing ones as examples
Great for
- Security testers who already use the nuclei scanner and want ready-made checks
- Bug bounty hunters looking for known issues across many web targets
- Security teams wanting to scan for actively exploited vulnerabilities using the kev and vkev tags
- Developers who want examples of how nuclei templates are written
Not ideal for
- People who only want a standalone app: this repo contains templates, and the nuclei scanner itself is a separate project
- Anyone scanning systems they do not have permission to test, since the templates actively probe targets
- Beginners with no security background, since results need interpretation
How to get it
- 1
Clone and build from source
You'll need: nuclei scanner (separate project at github.com/projectdiscovery/nuclei)
Clone the templates repository
git clone https://github.com/projectdiscovery/nuclei-templates - 2
Run it
- Install the nuclei scanner from the projectdiscovery/nuclei project
- Clone this repository to get the templates
- Run nuclei with a target and the templates directory, or filter by tag such as nuclei -tags kev,vkev
- Review findings and verify them manually before acting
- 3
Get the most out of it
- Filter by tags such as kev and vkev to focus on actively exploited vulnerabilities, as the README suggests
- Use the TEMPLATES-STATS.md file to browse templates by tag, author, directory, and severity
- Read the documentation at nuclei.projectdiscovery.io to learn how to write custom templates
- Contribute new templates through the repository's submission issue template
Downloads
Strengths
- Large collection, with the README reporting over 11,000 files across 873 directories
- Organized by tags, severity, author, and type, which makes filtering practical
- Open source under the MIT license and actively maintained, with a recent push and a published release
Trade-offs
- The templates only work with the separate nuclei scanner, so you must install and learn that tool first
- Scanning produces findings that still need manual verification; the README does not describe accuracy rates
- Community contributions vary in quality and coverage, which the README does not measure
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| nuclei-templates (this) | 13.3k | Dev tool | intermediate | 4 days ago | Security testers who already use the nuclei scanner and want ready-made checks |
| nuclei | 32.5k | CLI | intermediate | 4 days ago | Security engineers who want to run community-maintained vulnerability checks against their own systems |
| h4cker | 30k | Curated list | beginner | 14 days ago | Students looking for a structured starting point in cybersecurity |
| mitmproxy | 46.6k | Dev tool | intermediate | 4 days ago | Developers debugging how an app talks to a backend API |
| chezmoi | 22.1k | Dev tool | intermediate | 4 days ago | People who use more than one computer and want their settings to match |
| RemoveWindowsAI | 13.6k | Dev tool | beginner | 7 days ago | Windows 11 users who want Copilot and Recall removed |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.