nuclei reports "no results" on authorized target with known CVE templates enabled
Fixes nuclei returning no results on an authorized target despite CVE templates: checking severity and tag filters, debugging matcher conditions, and confirming the target actually exposes the vulnerable surface. Use when you expected hits and got silence. Not for template load errors.
TL;DR
No results with CVE templates usually means the templates never fired their matchers, not that the target is clean. Check that severity and tag filters did not exclude them, debug one template with -debug to watch the matcher logic, and confirm the target actually exposes the service the CVE needs. Silence is a signal to investigate, never a clean bill of health.
No results found for the target (known CVE templates were enabled)Use this when
- nuclei completes normally but reports nothing.
- You enabled templates for CVEs you believe apply.
- The target is in your authorized scope.
Not for this skill when
- nuclei errors out. Fix the error first.
- You ran only the default template set. Enable the CVE templates explicitly.
Steps
- Check your filters first: rerun without -severity and -tags limits:
nuclei -u https://target.example.com -t ~/nuclei-templates/http/cves/. Verify: you see whether a filter was silently excluding everything. - Debug a single CVE template:
nuclei -debug -t ~/nuclei-templates/http/cves/2023/CVE-2023-XXXX.yaml -u https://target.example.com. Verify: you see the requests sent and which matcher condition failed. - Confirm the vulnerable surface exists: check the service version and path the template probes. Verify: the target actually runs the software and exposes the endpoint the CVE needs.
- Check for interference: a WAF or login wall can block the probe before the vulnerable code runs. Verify: the debug output shows the request reaching the application, not a block page.
- Document the negative result with the template IDs and versions used. Verify: your report states what was tested, not just "no findings".
Compatibility: nuclei 3.x with current nuclei-templates. CVE template paths follow the year-based layout.
Variant phrasings
nuclei no results cve templates
Same fix path, common phrasing.
nuclei finds nothing known vulnerability
Symptom-level search.
nuclei matcher not firing
The cause-flavored search.
Why it happens
CVE templates are precise: they probe a specific path, version, or behavior. A version string that differs, a path behind authentication, a WAF rule, or a severity filter that excludes the template's rating all produce silence. nuclei did its job; the conditions for a match were simply not met.
Edge cases / pitfalls
- "No results" is not "not vulnerable". State the coverage and its limits in the report.
- Debug output can be huge. Debug one template at a time.
- Some CVEs need authenticated sessions. Check whether the template supports session handling before concluding.
- Retest after any target change. A deploy during the engagement can close or open the surface mid-scan.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_Do-m1mnu5acLt8GyemgqLA