ProjectDiscovery vulnerabilities
We track 7 vulnerabilities in ProjectDiscovery products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest ProjectDiscovery vulnerabilities
- 7.3 High severity
nuclei: Improper Verification of Cryptographic Signature
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass si
- 7.5 High severity
Nuclei: Improper Control of Generation of Code
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
- 7.8 High severity
nuclei: Improper Neutralization of Special Elements used in an OS Command
Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execu
- 7.4 High severity
nuclei: Improper Neutralization of Special Elements used in an OS Command
Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to
- 9.8 Critical severity
Interactsh: Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login.
- 7.4 High severity
nuclei: Improper Neutralization of Special Elements used in an OS Command
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability spec
- 7.5 High severity
nuclei: Improper Limitation of a Pathname to a Restricted Directory
Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues wit