Nuclei
Fast vulnerability scanning driven by a community library of human-readable YAML templates.
About
Nuclei is an open-source vulnerability scanner from ProjectDiscovery built on a simple idea: every check is expressed as a small, human-readable YAML template describing the request to send and the matcher that proves a weakness exists. That design turns scanning into something the whole security community can review, audit, and extend, and the community-maintained nuclei-templates library ships thousands of templates covering known CVEs, misconfigurations, exposed panels, and leaked secrets, updated daily as new vulnerabilities are disclosed.
The engine is written in Go and built for speed, scanning many hosts and running thousands of templates concurrently across HTTP, DNS, TCP, file, and other protocols, streaming findings as they are confirmed. Results export to JSON, SARIF, and other formats, and it slots into CI/CD pipelines as well as ProjectDiscovery's wider toolchain for subdomain and endpoint discovery. It is a staple of bug bounty hunters and red teams, and equally useful to blue teams continuously scanning their own estate. The repository carries 32,061 GitHub stars at last check under the MIT licence.
What it can do
- YAML-template-driven vulnerability scanning
- Thousands of community templates, updated daily
- Multi-protocol: HTTP, DNS, TCP, file, WebSocket, and more
- High-concurrency scanning engine written in Go
- Template tags, severity, and CVE filtering
- CI/CD-ready with JSON, SARIF, and Markdown output
- Out-of-band interaction support
Setup
- Install Nuclei: download the release binary for your OS, use go install, or run the Docker image.
- Run nuclei -update-templates to pull the community template library.
- Point it at targets: nuclei -u https://example.com or -l hosts.txt.
- Narrow with -tags, -severity, or -id flags and export results with -jsonl for reporting.
Prerequisites
A Linux, macOS, or Windows machine; network access to scan targets you are authorized to test.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (TIER verified, metrics-v1). Evidence: 32,061 GitHub stars (checked 2026-10-16); active commits through Oct 2026; MIT licence; community template library of thousands of templates updated daily; ProjectDiscovery's wider offensive-security toolchain is widely adopted. Strengths: transparent, auditable YAML checks, genuinely fast engine, the de facto template standard for bug bounty and red teams. Docked for: (1) a scanner, not a full vulnerability-management platform, so triage and remediation workflows need other tooling; (2) template quality varies since anyone can contribute, so untrusted targets need scoped, reviewed templates. License: MIT.
★ 32,061 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.0/10
- Maintenance · recency, releases, issue load
- 9.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 1.0/10
- · 32,061 GitHub stars checked 2026-10-16; active commits through Oct 2026
- · Community template library of thousands of YAML templates updated daily
- · De facto standard for bug bounty and red-team scanning
- · Template quality varies; scope and review templates before use
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.