Topic starter
11/11/2026 6:01 pm
TL;DR: Template releases added 226 checks and covered 123 CVEs, with ProjectDiscovery highlighting about 10 actively exploited vulnerabilities from CISA’s KEV catalog. Exposure scanning becomes more useful when detection logic is precise enough to support triage, not just broader coverage.
Editorial analysis by NHI Mgmt Group, based on content published by ProjectDiscovery: “Nuclei Templates - April 2026”.
By the numbers:
- 226 new templates shipped across both releases
- 123 CVEs covered, including ~10 actively exploited vulnerabilities from CISA's KEV catalog
- 27 first-time contributors joined the community
Key questions
Q: Why do AI and LLM platforms need dedicated exposure checks?
A: AI and LLM platforms need dedicated exposure checks because model prompts, retrieval data, connectors and logs can disclose secrets, personal data or proprietary context outside ordinary application controls.
Q: How should security teams reduce false positives in AI vulnerability scanning?
A: Require scanners to prove reachability, exposure, and privilege context before findings are allowed to block delivery.
Q: How do template scanners detect exploited vulnerabilities at scale?
A: Template scanners match known patterns from public vulnerability intelligence against live targets and return exposure evidence without custom code for each issue.
Practitioner guidance
- Prioritise KEV-listed detections first Route actively exploited vulnerabilities into the highest-priority triage queue and attach owner, internet exposure and remediation SLA to each finding.
- Separate discovery from exploitability Use one workflow to inventory exposed services and a second to confirm whether the surface is actually reachable for the named weakness, especially on AI and LLM tooling.
- Tune matcher logic before expanding coverage Review false-positive drivers in credential-disclosure, default-login and access-control checks so new detections do not overwhelm analysts with low-confidence noise.
Bottom line: Template-based scanning is most valuable when it keeps pace with actively exploited vulnerabilities rather than only expanding raw coverage.
Glossary terms: Nuclei, Known Exploited Vulnerabilities Catalog, Template-Based Scanning, False Positive
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Template libraries now function as prioritisation engines, not just detection assets. A release that covers 123 CVEs, including actively exploited issues, changes the role of exposure scanning from inventory support to operational triage. The practical value is not the raw count of checks but the ability to distinguish what is newly reachable, already exploited and worth immediate action.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.
A question worth separating out:
Q: How should security teams prioritise vulnerabilities after an external scan?
A: Prioritise vulnerabilities by exposure, exploitability, and the identity path they can reach. A critical issue on an internet-facing system that controls authentication, privileged access, or sensitive API traffic should rise above a lower-rated flaw on an isolated asset. Remediation should be owned, time-bound, and validated through change management.
👉 Read our full editorial: Nuclei template coverage now tracks exploited vulnerabilities and AI risk