Featured Stories

ProjectDiscovery is Selected as a Top 10 Finalist for RSAC™ 2025 Conference 20th Annual Innovation Sandbox Contest

We’re excited to share that ProjectDiscovery has been named one of the Top 10 Finalists in the 2025 RSA Innovation Sandbox! On Monday, April 28, we’ll take the stage at RSA Conference in San Francisco to showcase how we’re rethinking vulnerability management from the ground up with speed, accuracy, and the power of open-source. The RSA Innovation Sandbox is widely regarded as the cybersecurity industry’s premier startup competition. Each year, 10 early-stage companies are selected to pitch live

CrushFTP Authentication Bypass - CVE-2025-2825

Enterprise file transfer solutions are critical infrastructure for many organizations, facilitating secure data exchange between systems and users. CrushFTP, a widely used multi-protocol file transfer server, offers an extensive feature set including Amazon S3-compatible API access. However, a critical vulnerability (CVE-2025-2825) was discovered in versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 that allows unauthenticated attackers to bypass authentication and gain unauthorized access

Vulnerability Research

IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)

A critical vulnerability (CVE-2025-1974) was recently discovered in the Kubernetes Ingress-NGINX Controller that allows unauthenticated remote code execution (RCE) on the ingress controller pod. Originally discovered by the Wiz research team (Nir Ohfeld, Ronen Shustin, Sagi Tzadik, Hillai Ben-Sasson) in late 2024 and disclosed in March 2025, CVE-2025-1974 is part of a series of vulnerabilities collectively called IngressNightmare. If you’re specifically looking to use the IngressNightmare dete

Vulnerability Research

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne

Vulnerability Research

Effortless Passive Detection Using Global Matchers in Nuclei

If you've ever found yourself repeatedly setting up the same matchers in multiple Nuclei templates, it's time to break free from that cycle. Meet global matchers, a killer feature in Nuclei that simplifies your detection workflow. Imagine having a single template that automatically hunts for specific patterns (like private keys, sensitive tokens, or webhooks) across every HTTP response from all your other templates. That's what global matchers do — and they do it effortlessly. In this post, we

Nuclei & Templates

Crafting DAST Nuclei Templates for OOB Template Engines Injection: A Practical Guide

We’re thrilled to announce the release of new DAST Out-of-Band Template Injection Templates tailored for various templating engines and programming frameworks. This update empowers us to assess vulnerabilities and misconfigurations in diverse tech stacks effectively. In this post, we’ll explore automating Out-of-Band Template Injection Testing, crafting custom vulnerability checks, and sharing the findings through the PDCP Cloud for streamlined collaboration. For those particularly interested i

Nuclei & Templates

Alibaba Cloud - Nuclei Templates v10.1.1 🎉

We're excited to tell you about Nuclei Templates release v10.1.1 ! This new version includes newly added Alibaba Cloud Review templates. In this blog post, we'll discuss automating Alibaba cloud misconfiguration review, creating custom checks, and sharing results on the PDCP Cloud for review. An Alibaba Cloud Configuration Security Review is essential for assessing and improving the security of your cloud infrastructure. It ensures that your resources are configured correctly, compliant with re

Nuclei & Templates

Advancing Asset Management - PDCP v0.8.9

We're excited to announce the release of version 0.8.9 of the ProjectDiscovery Cloud Platform. This update introduces significant enhancements to our asset management capabilities, focusing on asset inventory, AI-powered search, and improved user experience. Key Features in v0.8.9 Asset Inventory and Technologies The new interface for cataloging and organizing all assets along with their associated technologies in one place represents a significant advancement in asset management. Now, rega

Vulnerability Management

Enhancing Asset Discovery: ProjectDiscovery Cloud Platform (v0.8.8)

We're excited to announce the release of version 0.8.8 of the ProjectDiscovery Cloud Platform. This update brings significant enhancements to our asset discovery capabilities, introduces new features for Basic Tier (Free) users, and resolves several critical issues. Our primary focus remains on improving the visibility and analysis of discovered assets and refining the insights available to our users. Empowering Basic Tier (Free) Users Our mission at ProjectDiscovery is to make advanced secur

Vulnerability Management

Nuclei v3.2 Release with Authenticated Scanning, Advanced Fuzzing & more

We're thrilled to announce the launch of Nuclei v3.2.0. This latest version introduces a host of new features, enhancements, and bug fixes, significantly elevating the Nuclei engine's performance and capabilities. Notably, the inclusion of authentication support and advanced fuzzing support positions this release as a pivotal milestone, further building upon the foundation laid by version 3.0.0. In this blog, and a number of upcoming feature spotlights, you'll learn a lot more about all that nu

Vulnerability Management

Bug Bounty Etiquette: Our Guide to Polite Hacking (Part Two)

This is the second part of our series on bug bounty etiquette. Part one looks at what you should be doing. Last month we talked about bug bounty etiquette and how to be a good bug bounty hunter; not in the sense of finding more bugs, but rather in how to be the kind of bug bounty hunter people want to work with. This time, we have some advice about what NOT to while bug bounty hunting. Let's get started. 1. Don’t go all out 2. Don’t ignore the rules 3. Don’t report unnecessary stuff 4. Do

Learning & Automation

Bug Bounty Etiquette: More than Ethical Hacking (part one)

This is part one of our two-part series on polite hacking, focusing on what to do. Part two talks about what not to do (link coming soon). This blog is not about techniques. It’s not about tools to use, how to find the vulnerability, or anything like that. There are plenty of those out there. It’s much more like an etiquette guide for Bug Bounty reporting, and how working within these social norms can lead to better outcomes for you in your career! Think of it like a cotillion class, or the fa

Learning & Automation

Getting Started with ProjectDiscovery in Linux and Windows

"Just for you, we’ve got this brand new blog all about getting started with ProjectDiscovery on Linux AND Windows."

Learning & Automation

ProjectDiscovery is Selected as a Top 10 Finalist for RSAC™ 2025 Conference 20th Annual Innovation Sandbox Contest

Announcements

March 2025 Newsletter

Our highlight this month? A massive addition of 359 brand-new Nuclei templates—all thanks to our incredible community contributors. Dive into the details of this impressive milestone in our dedicated newsletter and find out exactly what's new!

Announcements

February 2025 Newsletter

First, we’re so excited to announce that we’ve reached 100,000 GitHub stars across our OSS projects! This wouldn’t have been possible without everyone who’s contributed, used our tools, and offered their support along the way. Thank you, and we can’t wait to keep building with you! 🎉

Announcements

View all stories

Featured Stories

ProjectDiscovery is Selected as a Top 10 Finalist for RSAC™ 2025 Conference 20th Annual Innovation Sandbox Contest

CrushFTP Authentication Bypass - CVE-2025-2825

IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

Vulnerability Research Stories

CrushFTP Authentication Bypass - CVE-2025-2825

IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

Nuclei & Nuclei Template Stories

Effortless Passive Detection Using Global Matchers in Nuclei

Crafting DAST Nuclei Templates for OOB Template Engines Injection: A Practical Guide

Alibaba Cloud - Nuclei Templates v10.1.1 🎉

Vulnerability Management Stories

Advancing Asset Management - PDCP v0.8.9

Enhancing Asset Discovery: ProjectDiscovery Cloud Platform (v0.8.8)

Nuclei v3.2 Release with Authenticated Scanning, Advanced Fuzzing & more

Educational Stories

Bug Bounty Etiquette: Our Guide to Polite Hacking (Part Two)

Bug Bounty Etiquette: More than Ethical Hacking (part one)

Getting Started with ProjectDiscovery in Linux and Windows

Company Announcements

ProjectDiscovery is Selected as a Top 10 Finalist for RSAC™ 2025 Conference 20th Annual Innovation Sandbox Contest

March 2025 Newsletter

February 2025 Newsletter

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company