v9.2.2 v10.4.8
high risk
facebook/lexicalAug 23, 2026 → Aug 24, 20261 day between releases
What's New
Major version jump adds 112 security templates and fixes regex matching issues
Breaking Changes
- Major version bump from 9.x to 10.x
New Features
- 112 new vulnerability templates and 101 CVEs targeting CMS, DevOps, and enterprise software
- Milvus fingerprinting support via milvus-detect.yaml
- Response-validity error checks added to snmpv3-detect
- Refactored templates for Argo CD and Airflow
Improvements
- Fixed false negatives in regex matchers
- Fixed false positives for WAF block pages and benign Next.js redirects
- Severity audit raising 9 info-level templates
- Extended milvus-detect.yaml to fingerprint Milvus
Bug Fixes
- Fixed false negatives in CVE-2027-5521 and CVE-2027-7615
- Fixed false positives for WAF block pages and benign Next.js redirects
Upgrade Notes
Major version bump implies potential breaking changes; verify configuration compatibility between Auth and Security scanning modules.
The Two Releases
v9.2.2
v9.2.2
Aug 23, 2026· 2 months ago
This patch release restores the browser Basic Auth prompt for the UI and REST API while ensuring OAuth 2.1 is correctly scoped to the MCP transport.
Full release notesv10.4.8
Nuclei Templates v10.4.8 - Release Notes
Aug 24, 2026· 2 months ago
Adds 112 templates and 101 CVEs targeting high-severity flaws in CMS, DevOps, and enterprise software. Includes fixes for false negatives in regex matchers and false positives related to WAFs and benign redirects.
Full release notes