nuclei-templates is the community-curated template library powering the nuclei scanning engine, giving authorized testers detection coverage across thousands of CVEs, exposures, and misconfigurations.

nuclei-templates is the content backbone of the nuclei ecosystem: without templates, the nuclei engine from projectdiscovery is just an execution runtime with nothing to execute. This repository, sitting at roughly 12973 stars under the MIT license, houses the official and community-contributed detection corpus that turns the scanner into a practical vulnerability discovery tool. What makes it interesting from an editorial standpoint is not the code — the repo is largely JavaScript-tagged YAML content — but the sheer scale and curation model. It is one of the largest continuously maintained detection libraries in offensive security, and its structure tells you a lot about how modern scanning has evolved.

The numbers in the README are the first thing worth unpacking. The repository contains 11997 files spread across 873 directories, organized by protocol and technology: http dominates with 9281 templates, followed by cloud at 659, file at 436, network at 259, code at 251, dast at 240, workflows at 205, javascript at 92, ssl at 38, and dns at 23. That distribution reflects reality: most modern attack surface is web-facing HTTP, so the majority of detection logic lives there. But the presence of dns, ssl, and network directories shows the engine's multi-protocol reach, and code templates — which execute embedded helper logic — are a distinct class worth understanding before you enable them.

Severity tagging across the corpus is also telling: 4353 templates are tagged info, 2552 high, 2457 medium, 1555 critical, 330 low, and 54 unknown. The fact that informational checks are the single largest bucket matters operationally — a default run of the full corpus is more reconnaissance and fingerprinting than exploitation. Senior operators know that tuning by severity, using flags like -severity critical,high, is how you turn this firehose into a usable signal stream rather than a triage nightmare.

The tag taxonomy is where the library becomes genuinely navigable. vuln leads at 6468 templates, followed by cve at 3587, discovery at 3265, panel at 1365, xss at 1269, wordpress at 1261, exposure at 1141, wp-plugin at 1103, and osint at 848. The heavy WordPress and plugin coverage is a pragmatic reflection of internet-wide deployment patterns — CMS plugins remain one of the most common sources of exploitable surface. The panel and exposure tags are reconnaissance-oriented, mapping login interfaces and accidentally exposed data respectively, which is exactly the kind of content that dominates external attack surface reviews in authorized engagements.

Perhaps the most strategically valuable feature documented in the README is the Known Exploited Vulnerabilities coverage. The repo maintains 454 templates mapped to the CISA KEV catalog, 1449 mapped to VulnCheck KEV, and 407 covering both, for 1496 unique KEV templates total. The README explicitly suggests filtering with nuclei -tags kev,vkev to scan for actively exploited vulnerabilities. This is the correct prioritization logic for defenders too: if you can only patch a subset of findings, KEV-tagged items are the ones with demonstrated in-the-wild exploitation.

Authorship statistics reveal the curation model in action. dhiyaneshdk leads with 1894 templates, followed by daffainfo at 905, princechaddha at 854, dwisiswant0 at 805, ritikchaddha at 678, pussycat0x at 675, and pdteam — the maintainers themselves — at 314. This concentration among a handful of prolific contributors is both a strength and a diligence point: a small group effectively curates what a large community scans with. For an operator, that argues for reviewing templates from less-familiar authors before including them in an engagement corpus, and for pinning to tagged releases rather than tracking main blindly.

Contributions flow through pull requests and a dedicated GitHub issue template for template submissions, with feature requests and bug reports separated into their own intake forms. The project also maintains TEMPLATES-STATS.md and a machine-readable TEMPLATES-STATS.json for programmatic integration — a small but thoughtful detail that lets teams build internal dashboards tracking which coverage areas lag behind new CVE disclosures. Documentation for authoring custom templates lives at nuclei.projectdiscovery.io, and the README notes that example templates are included in-repo to learn the format.

In an authorized workflow, the typical pattern is straightforward: install the nuclei engine, which pulls or updates templates via nuclei -ut, then run targeted scans with -tags, -severity, or -t pointing at specific directories against in-scope hosts. The template directory model — http/cves/, http/exposures/, and so on — maps naturally to engagement scoping. For bug bounty work, filtering by technology tags like wordpress or wp-plugin against programs that explicitly permit automated scanning keeps you inside the rules of engagement.

Defensively, this repository is equally valuable. Blue teams can mirror it as a detection content source: every template describes a specific, testable condition — a path, a response pattern, a version signature — which translates directly into WAF rules, IDS signatures, or asset inventory queries. Because nuclei traffic is noisy and patterned, template execution is observable in SIEMs as bursts of probe requests, and defenders correlating their own scans against log telemetry can validate that monitoring catches the same conditions the templates assert.

There are practical watch-points. Template quality varies with the long contributor tail, false positives on info-class checks are common on heavily customized applications, and code templates execute helper logic that some hardened deployments disable by default for safety reasons. The unknown severity bucket, while small at 54, is another reason to filter deliberately rather than run everything. Responsible use means confirming scope authorization before any scan, since the full corpus generates substantial traffic against every target.

The community infrastructure — an active Discord, GitHub discussions, Twitter updates at pdnuclei, and a hacktoberfest topic — indicates sustained maintenance velocity rather than an abandoned dump. Combined with the KEV tracking, the release cadence, and the machine-readable stats, nuclei-templates functions less like a static list and more like living detection intelligence. For any authorized assessment or exposure audit, it remains the reference corpus against which alternatives are measured.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.