projectdiscovery has 8 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. Most affected products: nuclei (5), github.com/projectdiscovery/nuclei/v3 (2), github.com/projectdiscovery/nuclei/v2 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- nuclei 5
- github.com/projectdiscovery/nuclei/v3 2
- github.com/projectdiscovery/nuclei/v2 1
Worst active — by depth score
CVE-2026-92718High· 7.3Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums52CVE-2026-76819High· 8.6Rejected reason: Further research determined the issue results from a dependency.47CVE-2023-37896High· 7.5Nuclei Path Traversal vulnerability41CVE-2026-76804Medium· 5.5Nuclei is a vulnerability scanner built on a simple YAML-based DSL30CVE-2026-76805Medium· 5.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL29
projectdiscovery vulnerabilities
CVEs affecting projectdiscovery, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-76819High· 8.6Rejected reason: Further research determined the issue results from a dependency.
Rejected reason: Further research determined the issue results from a dependency.
CVE-2026-76805Medium· 5.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that all…
CVE-2026-76804Medium· 5.5Nuclei is a vulnerability scanner built on a simple YAML-based DSL
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. …
CVE-2026-76803Medium· 5.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN opti…
CVE-2026-76802Medium· 4.7⚖ disputedNuclei is a vulnerability scanner built on a simple YAML-based DSL
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzz…
CVE-2026-92718High· 7.3PoCNuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modific…
CVE-2026-41282Medium· 5.3Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
CVE-2023-37896High· 7.5Nuclei Path Traversal vulnerability
Nuclei Path Traversal vulnerability