Nuclei Template Feeds: Community Templates, the Volume Problem, and KEV/EPSS Prioritization

Nuclei is the de facto standard for template-based vulnerability scanning, and its community template library is one of the great free resources in security. So, as with IOCs, the interesting question is not "where do I get templates" but "which of the tens of thousands do I run, and in what order". That prioritization problem is where a curated template feed earns its place.

The free baseline: community templates

The Nuclei engine is open source, and ProjectDiscovery maintains a large, MIT-licensed community template repository covering CVEs, misconfigurations, exposures and default credentials across a huge range of technologies. It is actively contributed to and genuinely excellent. For most teams, the engine plus community templates is the starting point, and it is free.

The catch is scale. When your template set numbers in the tens of thousands, "scan everything" is neither fast nor useful. You get a flood of findings with no built-in sense of which ones matter right now. Coverage was never the problem; prioritization is.

The volume problem, concretely

Running a full community template set against a large estate produces a lot of output and a lot of noise. Two templates may target the same CVE with different quality. A template may fire on an exposure that is real but irrelevant to your risk. And nothing in the raw set tells you which CVE is being actively exploited in the wild today versus which is a theoretical finding from three years ago.

That is the gap a curated feed fills: not more templates, but the right templates, deduplicated, and ordered by real-world risk.

How to prioritize Nuclei templates yourself

You do not need a paid feed to start prioritizing. The order below turns a "scan everything" run into a focused, risk-ranked queue using only the open engine and two free public datasets: CISA KEV and EPSS.

1. Cut by severity and intent first. Do not run the whole set. Scope to CVEs and drop the informational noise:

nuclei -l targets.txt -tags cve -severity critical,high -jsonl -o findings.jsonl

2. Only scan the stack that is actually there. Automatic scan fingerprints each target and runs only the templates matching the detected technologies, which removes most of the irrelevant pile:

nuclei -l targets.txt -as

3. Scan what is actively exploited, first (CISA KEV). The single highest-value filter. Pull the KEV catalog, then run only the templates whose CVE is on it. Nuclei's CVE templates are named after their CVE id, so the join is a filename match:

# exploited-in-the-wild CVE ids
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[].cveID' > kev.txt
 
# resolve them to template files and scan only those
while read cve; do find ~/nuclei-templates -iname "${cve}.yaml"; done < kev.txt > kev-templates.txt
nuclei -l targets.txt -t kev-templates.txt

4. Rank the rest by exploit probability (EPSS). For everything not on KEV, EPSS gives a 0–1 probability that a CVE will be exploited. Keep a threshold and scan those next:

# CVEs with EPSS probability >= 0.5
curl -s https://epss.cyentia.com/epss_scores-current.csv.gz | gunzip \
  | awk -F, 'NR>2 && $2+0 >= 0.5 {print $1}' > epss-high.txt

The union of the KEV set and the EPSS-high set is your priority queue; the long tail waits. Refresh both datasets before each cycle — KEV and EPSS change constantly, and stale enrichment quietly re-randomizes your order.

The curated + prioritized approach (ThreatClaw)

The manual workflow above is exactly the join a curated feed automates and keeps current. The ThreatClaw Nuclei feed takes the open template ecosystem and does the operational work on top:

• Aggregated from multiple MIT sources, then deduplicated by id and by content hash. One best version per CVE, not four near-duplicates from different repos.
• Tested on the real engine, so you are not shipping templates that error out or misfire.
• Enriched with CISA KEV and EPSS. Templates are joined against the CISA Known Exploited Vulnerabilities catalog and ranked by EPSS (exploit-prediction score). You scan what is being exploited right now, first, instead of scanning tens of thousands of things at random.
• Signed and continuously maintained.

The value is the prioritization layer. A KEV-flagged, EPSS-ranked subset turns an unmanageable scan into a focused one: the actively exploited, high-probability issues surface first, and the long tail waits. Concretely, every bundle ships an INDEX.csv ranked KEV-first then EPSS, and there is a dedicated KEV Rapid-Response bundle — templates whose CVE is in CISA KEV, ordered by EPSS, meant to be scanned first.

The criteria that actually matter for template feeds

• Prioritization signal. Does the feed tell you what to scan first (KEV, EPSS, exposure of the target stack), or hand you a flat pile? This is the whole value on top of the free set.
• Deduplication. Multiple repos carry overlapping templates. Dedup by id and content hash gives you one good version per issue.
• Tested templates. A template that errors or false-fires wastes a scan. Ask whether templates are validated against the engine.
• Freshness. New CVEs and exploits appear constantly. The prioritization is only useful if KEV/EPSS joins are kept current.
• License. Community templates are MIT, which is permissive, but if you aggregate and redistribute, verify the composite license.

How to choose

• You scan occasionally and can triage manually. The free Nuclei community templates are an excellent baseline.
• You scan a large estate and need to act on results. A feed that deduplicates and prioritizes by KEV/EPSS turns the volume into a workable queue. That is what the ThreatClaw Nuclei feed is built for, as part of the wider feeds catalog.

FAQ

How do I prioritize which Nuclei templates to run?

Scope by severity and tags, fingerprint the target stack with automatic scan (-as) so you only run relevant templates, then rank by real-world risk: scan the CVEs on the CISA KEV catalog first (actively exploited), and order the rest by EPSS probability. The step-by-step commands are in the section above.

Can I do KEV/EPSS prioritization without a paid feed?

Yes. CISA KEV and EPSS (FIRST.org) are both free and public, and Nuclei's CVE templates are named by CVE id, so you can join them with a few lines of shell, as shown above. A curated feed automates, tests and refreshes that join for you daily; the method itself is open.

Are the community Nuclei templates enough?

For coverage, absolutely, they are excellent and free. The gap is prioritization: with tens of thousands of templates, you need a way to scan the actively exploited, high-risk issues first. That ordering, not more templates, is what a curated feed adds.

What do KEV and EPSS add to a template feed?

CISA KEV flags vulnerabilities known to be actively exploited; EPSS estimates the probability a vulnerability will be exploited. Joining templates to both lets you scan the highest-risk, actively exploited issues first instead of scanning at random.

How is a Nuclei feed different from a SIEM detection feed?

Nuclei templates actively probe systems for vulnerabilities and exposures (scanning). Sigma or NIDS rules passively detect malicious activity in logs and traffic. They answer different questions: "what am I exposed to" versus "what is happening", which is why they sit in the same feeds catalog but serve different workflows.