v12.2.0 v10.4.7
low risk
ysharma3501/NovaSRJul 29, 2026 → Aug 3, 20265 days between releases
What's New
Added 122 new security templates and fixed matcher logic and false positives.
New Features
- Added 122 new templates covering critical vulnerabilities in WordPress, Gitea, and other platforms.
- Added critical CVEs including WordPress Batch-Route Confusion and Gitea RCE.
- Added critical CVEs including Dockwatch OS Command Injection and Balbooa Forms File Upload.
- Added critical CVEs including Page Builder CK File Upload and Joomla SP Page Builder RCE.
- Added critical CVEs including Flowise RCE and Apache Solr Hardcoded Credentials.
Improvements
- Fixed false negatives in MongoDB detection for version 6.0+.
- Fixed credential-stuffing templates to no-op when no credentials are supplied.
- Fixed false positives in templates like nfs-v3-exposed and CVE-2025-32969.
Bug Fixes
- Fixed credential-stuffing templates to no-op when no credentials are supplied.
- Fixed false positives in templates like nfs-v3-exposed and CVE-2025-32969.
- Fixed false negatives in MongoDB detection for version 6.0+.
Upgrade Notes
No configuration changes required based on release notes.
The Two Releases
v12.2.0
v12.2.0
Jul 29, 2026· 3 months ago
This release significantly updates the application editor and security model by replacing TinyMCE with Tiptap and restricting sensitive admin fields for minimal app access. It also introduces new import capabilities and environment variables to manage asset transformation and data limits.
Full release notesv10.4.7
Nuclei Templates v10.4.7 - Release Notes
Aug 3, 2026· 3 months ago
A major security template release adding 122 new templates and fixing matcher logic and false positives across the suite.
Full release notes