VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/projectdiscovery/nuclei/v3: vulnerability history, versions and safety

github.com/projectdiscovery/nuclei/v3 is a package in the Go ecosystem. Vulert records 10 vulnerabilities for it across 120 releases, from Mar 2024 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
10 vulnerabilities recorded H3 M7
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
7 in the last 12 months

Most recent disclosure 22 Sep 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/projectdiscovery/nuclei/v3 vulnerabilities

Vulert verdict on github.com/projectdiscovery/nuclei/v3 v3.11.1 i

Updated on 23 Oct 2026

Action needed: v3.11.1 has 1 known vulnerability, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 75/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v3.11.1 — affected i
  • Vulnerabilities on record 10 over 2 years · 7 in the last year i
  • Latest disclosure 22 Sep 2026 i
  • Highest CVSS 8.6 i
  • With no published fix 0 i
  • Stars 32,074 i
  • OpenSSF scorecard 5/10 i
  • Last release 2 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/projectdiscovery/nuclei/v3, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v3.11.2-0.20261020145814-b0eeadc5541e 20 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261019182619-f3b817b818a6 19 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261018151950-10f1967cdcde 18 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261017233043-6a42a7bf5211 17 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261014130657-a151a1d54fad 14 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261013164943-a99715a1e9c2 13 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261013164640-86d437fd8429 13 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261013163209-a5715288aa7e 13 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261012083323-59e6ffa6fb51 12 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261009191147-a48a58ef5967 09 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261005132240-1884ed920f54 05 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261005124801-33365561879d 05 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261004223224-588ebb3e2277 04 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20261002194014-12189e8f9038 02 Oct 2026 H1 MIT Yes Details →
v3.11.2-0.20260929191011-54f931094580 29 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260929062305-db8108f87d0f 29 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260929045334-8dd9f0d668d2 29 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260926015956-c5611b9ac4c5 26 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260924175048-71f9782b2c85 24 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260921062244-d47ace7701e2 21 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260918005321-37c06098add1 18 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260914210521-66068dbec224 14 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260914153858-9caed5fe5919 14 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260914062251-59f4635e8c5f 14 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260912170143-42bdc59731f5 12 Sep 2026 H1 MIT Yes Details →
v3.11.2-0.20260910020943-a04aba1022ef 10 Sep 2026 H1 MIT Yes Details →
v3.6.3-0.20260826033925-da279d42a37f 26 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260824061716-84b464e6bdc2 24 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260820085223-bb79d8ed71fc 20 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260817061828-34866efc2274 17 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260815071938-265b3a3dec37 15 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260810061934-dd7153518e7b 10 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260809055528-dfdfa5fd6550 09 Aug 2026 H1 MIT Yes Details →
v3.11.1 08 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260805100754-64bc83e00455 05 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260804032411-9de96e4dda5a 04 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260803061857-4a6f7c5a868d 03 Aug 2026 H1 MIT Yes Details →
v3.6.3-0.20260730120159-3a136a8432ff 30 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260729210033-bfd4e500961f 29 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260727195443-d36f4c16b1ee 27 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260727120949-ba05210f16e2 27 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260727090718-7936ec36d8bc 27 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260726075553-e2e3574f595b 26 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260726060316-16e4a7acc967 26 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260725082327-6ecdb947408d 25 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260721121136-6d7a0fa435f4 21 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260720070143-4e422a93084f 20 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260717223623-0888e6244d17 17 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260716181308-c928dcc6523a 16 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260713065315-9c47e6c12241 13 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260707185514-85723be139cf 07 Jul 2026 H1 MIT Yes Details →
v3.11.0 06 Jul 2026 H1 MIT Yes Details →
v3.6.3-0.20260703001817-1427b35cdbcb 03 Jul 2026 H1 MIT Yes Details →
v3.10.0 30 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260629205315-ccbfb12bd014 29 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260629180021-1e294aa7b908 29 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260629063319-d63d0228d036 29 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260629053522-f82673434c64 29 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260624082503-2d840752c6b7 24 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260623222259-1512979e8148 23 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260622222717-68daef44a7ea 22 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260622091831-323df47351d1 22 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260619161633-85abc4f90f28 19 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260619145546-1c440e755a97 19 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260617135826-c0b1f4b3bff9 17 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260616182746-0d7855874f7d 16 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260615062008-acff3e3c3ada 15 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260613154337-7f6096ee6602 13 Jun 2026 H1 MIT Yes Details →
v3.9.0 10 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260610014443-16743c67815c 10 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260608182748-da1212c30481 08 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260604153351-20cbf0bd7389 04 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260603141521-7414bcbf896d 03 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260603132548-1c961293b4a0 03 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260601192328-b625d9a70615 01 Jun 2026 H1 MIT Yes Details →
v3.6.3-0.20260530071606-bbc010b637e9 30 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260525160328-0bc707a1f7ab 25 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260523013525-fa73d2e13e5b 23 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260514185258-ce28f2028daa 14 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260512125924-609cf3daba73 12 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260512110135-fbf7d0053fb8 12 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260512105857-7bded8ae8db2 12 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260512092517-642887e985e5 12 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260506122702-54f002db4ab0 06 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260504215325-57ec28c0402d 04 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260504062823-a4da890fb058 04 May 2026 H1 MIT Yes Details →
v3.6.3-0.20260429172546-a3c07e3ef91f 29 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260427063526-b6385767bea2 27 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260424155535-cd1bfe8d8714 24 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260423214959-e1f09e9959b6 23 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260420062634-ad4f3ffd57d6 20 Apr 2026 H1 MIT Yes Details →
v3.8.0 16 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260416081755-ad74c601c494 16 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260415122229-1f20707c9a5d 15 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260415062325-0383fbfcb85a 15 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260410160917-6c803c74d193 10 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260410010639-6f2ade6a9b42 10 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260408024147-4eb0b22ac418 08 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260401092503-c6fb1ae48618 01 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260401075313-3537030e1fd6 01 Apr 2026 H1 MIT Yes Details →
v3.6.3-0.20260330174039-4ae87beeddc0 30 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260330061758-78dbaebd4abc 30 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260320014018-67e880691b2f 20 Mar 2026 H1 — Yes Details →
v3.0.0-20260316061852-b0998529c66c 16 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260309214658-979c867301f0 09 Mar 2026 H1 — Yes Details →
v3.7.1 05 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260305035950-884d0b5bed22 05 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260304202538-51205f847029 04 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260304133933-70ac8bf72ba6 04 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260302062211-b2ab7d3fea22 02 Mar 2026 H1 — Yes Details →
v3.6.3-0.20260227224536-73507cde1c2f 27 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260226114525-9142eae3a7dd 26 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260225200110-72b691904766 25 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260225123445-10421e9d003f 25 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260223062705-d771daa564ce 23 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260219195519-eee0bf373cc1 19 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260217040814-50e3131d8634 17 Feb 2026 H1 — Yes Details →
v3.6.3-0.20260211001955-2e1a81e6e9ce 11 Feb 2026 H1 — Yes Details →
v3.7.0 28 Jan 2026 H1 — Yes Details →
v3.6.3-0.20260126063053-e514c3149231 26 Jan 2026 H1 — Yes Details →

The newest 120 of 580 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 3
  • 2026 7

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 7 of the 10 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/projectdiscovery/nuclei/v3

The 5 most severe of 10 vulnerabilities recorded for this package

Search all 10 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-76819: Nuclei Arbitrary Code Execution via Goja JavaScript Engine Vulnerability 8.6 high 3.10.0 22 Sep 2026
CVE-2024-27920: Nuclei allows unsigned code template execution through workflows 7.4 high 3.2.0 15 Mar 2024
CVE-2024-40641: Unsigned Code Template Execution in projectdiscovery/nuclei 7.4 high 3.3.0 17 Jul 2024
CVE-2024-43405: Nuclei Template Signature Verification Bypass 7.4 medium 3.3.2 04 Sep 2024
CVE-2026-41646: Nuclei Local File Read Vulnerability via require() Module Loader Bypass 5.5 medium 3.8.0 22 Apr 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/projectdiscovery/nuclei/v3

Is github.com/projectdiscovery/nuclei/v3 safe to use?

Vulert records 10 vulnerabilities for github.com/projectdiscovery/nuclei/v3 in Go: 0 critical, 3 high, 7 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/projectdiscovery/nuclei/v3's Vulert package health score?

Vulert scores github.com/projectdiscovery/nuclei/v3 75/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/projectdiscovery/nuclei/v3 affected?

Yes. v3.11.1, the version you would install today, has 1 known vulnerability, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/projectdiscovery/nuclei/v3 should I use?

v3.11.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/projectdiscovery/nuclei/v3 have?

10 vulnerabilities are recorded for github.com/projectdiscovery/nuclei/v3 in the Go ecosystem: 0 critical, 3 high, 7 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/projectdiscovery/nuclei/v3 vulnerabilities disclosed?

7 vulnerabilities were recorded for github.com/projectdiscovery/nuclei/v3 in the last 12 months, and the oldest entry in this database dates to 15 Mar 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/projectdiscovery/nuclei/v3 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/projectdiscovery/nuclei/v3 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/projectdiscovery/nuclei/v3 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.