nuclei-templates Releases

This release focuses on critical vulnerabilities in file transfer tools and enterprise monitoring systems, adding 105 new templates. Highlights include RCEs in RClone, command injection in Fortinet FortiSandbox, and pre-auth RCEs in OpenAM and Nginx UI.

May 5, 2026

This release introduces KVM sandboxing support for accelerated virtual machines, exposes SDK settings schema, and adds LLM model information to the conversation interface.

May 1, 2026

This release focuses on auto-localization features, new audio format support for Nintendo 3DS/Wii, and introduces environment variable expansion support in configuration files.

Apr 24, 2026

A patch release adding Kimi K2.6 model support, improved sampling defaults, and bug fixes for M5 series Macs and RDMA.

Apr 23, 2026

This release introduces Windows service support and full TSIG verification across DoH, DoH3, QUIC, and gRPC transports. It also includes performance optimizations, security fixes, and enhancements to cache prefetching and zone transfer behavior.

Apr 22, 2026

Introduces multimodality support, adds new AI models (Gemma 4, Minimax M2.7, Qwen3.6), and significantly reduces memory usage with Flash Attention for long context use cases.

Apr 17, 2026

Adding 121 templates and 61 CVEs, this release highlights critical RCEs in Fortinet FortiClientEMS, Marimo, and Flowise, as well as path traversal in Spring Framework. It also addresses significant improvements to false positive reduction in credential disclosure templates.

Apr 15, 2026

Adds browser interaction capabilities, new SDKs (Java and Elixir), and advanced PDF parsing options including OCR modes and a dedicated Wikimedia engine. Also introduces a `query` format for direct answers.

Apr 10, 2026

This release adds 76 templates and 42 CVEs, focusing on authentication bypasses in low-code platforms and critical privilege escalations in system utilities. Key additions include vulnerabilities in Budibase, Citrix NetScaler, and BMC FootPrints.

Mar 31, 2026

This update adds new functionality such as hooks, slash commands, and language support, alongside fixes for conversation persistence. Key highlights include the addition of the `/clear` and `/new` slash commands, Catalan language support, and a copy button for code blocks.

Mar 30, 2026

This release focuses on performance improvements with continuous batching enabled by default and adds support for new AI models and hardware. Key highlights include Qwen3.5 support, M5 Pro/Max chip support, and a new cancel endpoint for text generations.

Mar 27, 2026

This release adds cosmetic filtering capabilities via `.hidden` files and improves thumbnail handling, along with various bug fixes. Key highlights include the new `.hidden` file support, thumbnail pregeneration, and the ability to grant `.` permissions for dotfiles in shares.

Mar 23, 2026

Adds 94 templates and 47 CVEs, highlighting critical RCEs in Qwik, Langflow, and multiple SolarWinds Web Help Desk vulnerabilities.

Mar 16, 2026

This release introduces a planning agent and a new UI tab to track tasks, alongside support for new AI models and Bitbucket. Key highlights include the addition of a slash command menu, support for models like Claude Opus 4.6 and GLM-4.7, and Bitbucket datacenter support.

Mar 11, 2026

This release introduces support for Proxy Protocol to preserve client IPs behind load balancers and includes several security patches. Key highlights involve improved DNS logging metadata, stronger randomness for loop detection, and fixes for ACL bypass and Kubernetes plugin crashes.

Mar 6, 2026

This release focuses on reverse proxy enhancements, performance optimizations, and security patches. Key highlights include improvements to PROXY protocol handling, dynamic upstream tracking, and the addition of `zstd` compression for logs. Two CVEs were patched, and the build was updated to Go 1.26.1.

Mar 6, 2026

A substantial update adding support for multiple new AI models and APIs, redesigning the web dashboard, and improving user experience and stability.

Feb 25, 2026

A maintenance release primarily addressing a broken release process and includes critical security patches alongside quality-of-life improvements like log rotation and automatic ECH key rotation.

Feb 23, 2026

Primarily adds support for the MiniMax-M2.5 model and fixes a startup error regarding resumed conversations.

Feb 18, 2026

Major release with 182 new templates and 116 CVEs added, featuring critical vulnerabilities like BeyondTrust Remote Support WebSocket RCE, SolarWinds Web Help Desk JNDI Injection, and Laravel Livewire RCE. The release includes significant bug fixes for false positives/negatives and enhancements to detection templates.

Feb 16, 2026