Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/projectdiscovery/nuclei/v3

10 known vulnerabilities (3 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 3 high, 7 medium
Registry
pkg.go.dev

Advisories 10

  • CVE-2026-76805Medium 5.3

    Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

    Affected: from 3.0.0, fixed in 3.10.0.

  • CVE-2026-76802Medium 4.7

    Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

    Affected: from 3.0.0, fixed in 3.10.0.

  • CVE-2026-76804Medium 5.5

    Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

    Affected: from 3.0.0, fixed in 3.10.0.

  • CVE-2026-76803Medium 5.3

    Nuclei: Local File Read via MySQL Client Sandbox Bypass

    Affected: from 3.0.0, fixed in 3.10.0.

  • CVE-2026-41645Medium 5.3

    Nuclei: Environment variable disclosure via Response-Derived DSL Expressions

    Affected: from 3.0.0, fixed in 3.8.0.

  • CVE-2026-41646Medium 5.5

    Nuclei: Local File Read via require() Module Loader Bypass

    Affected: from 3.0.0, fixed in 3.8.0.

  • CVE-2026-41282Medium 4.0

    ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection.

    Affected: from 3.0.0, fixed in 3.8.0.

  • Nuclei Template Signature Verification Bypass

    Affected: from 3.0.0, fixed in 3.3.2.

  • Unsigned code template execution through workflows in projectdiscovery/nuclei

    Affected: fixed in 3.3.0.

  • Unsigned code template execution through workflows in projectdiscovery/nuclei

    Affected: from 3.0.0, fixed in 3.2.0.