Nuclei

Nuclei is a fast, customizable vulnerability scanner based on templates, developed by ProjectDiscovery and designed for security researchers, penetration testers, and bug bounty hunters. Written in Go with over 21,300 stars as of 2026, Nuclei uses a YAML-based template engine that separates scanning logic from vulnerability definitions, enabling the community to write and share detection rules for specific CVEs, misconfigurations, exposed sensitive data, and technology fingerprinting. As of 2026, the Nuclei Templates repository contains over 9,000 templates covering known vulnerabilities (CVE-mapped), security misconfigurations (exposed admin panels, default credentials, open databases), exposed tokens and secrets (API keys, cloud credentials), technology detection (web servers, CMS, frameworks via Wappalyzer-style fingerprints), DNS checks (subdomain takeover, dangling CNAMEs, DNS zone transfer), code exposure detection (.git directories, backup files, source maps), and exposed internal services. Key features include: HTTP, DNS, TCP, SSL/TLS, WebSocket, and headless browser (via Rod) request support, template execution with conditional logic (matchers and extractors using regex, DSL, JSONPath, XPath, and keyword matching), rate limiting and concurrency control, protocol fuzzing, passive scanning mode, workflow files for chained scanning, integration with CI/CD pipelines and automation platforms, output formats (JSON, JSONL, Markdown, SARIF), and the Nuclei Cloud platform for managed scanning. Nuclei is the most downloaded security tool on the platform's security research community.