Vulnerabilities

Project Copacetic (copa) is a CLI tool for patching container image vulnerabilities directly without full image rebuilds, using vulnerability...

reconFTW is an automated reconnaissance framework designed for bug bounty hunters and penetration testers to enumerate subdomains, perform security...

CVE Binary Tool is a free, open-source security scanner that identifies known vulnerabilities in binaries and software components by matching against...

Dependency-Track is an OWASP-maintained Component Analysis platform that ingests Software Bill of Materials (SBOMs) to identify and mitigate supply...

ClusterFuzz is a scalable fuzzing infrastructure used by Google to find security and stability issues in software, powering both internal Google...

Bearer is an open-source static application security testing (SAST) tool that scans source code to identify security vulnerabilities and privacy...

OpenCVE is a vulnerability intelligence platform that aggregates CVE data from multiple sources (MITRE, NVD, RedHat, etc.) and provides filtering,...

CVE PoC is an automated aggregation repository that collects and organizes publicly available proof-of-concept exploits for CVEs, organized by year...

A curated collection of search engines and tools for security professionals conducting penetration testing, vulnerability assessments, and threat...

PwnDoc is a collaborative pentest reporting platform that streamlines the generation of customizable Word documents from security audit findings....

Grype is a vulnerability scanner that analyzes container images, filesystems, and SBOMs against known vulnerability databases. It serves DevOps...

A curated list of resources for web application security education and penetration testing, including books, documentation, tools, cheat sheets,...

npq is a command-line tool that audits npm packages before installation by checking against CVE databases, analyzing package metadata (age,...

OSS-Fuzz is a continuous fuzzing service that automatically discovers security vulnerabilities and stability bugs in open source software using...

Retire.js is a specialized security scanner that detects JavaScript libraries with known vulnerabilities in web and Node.js applications, addressing...

This project automatically aggregates proof-of-concept (POC) and exploit (EXP) code from GitHub, indexed by CVE ID. It serves security researchers,...

cve-search is a specialized security tool that imports CVE and CPE data into MongoDB to enable fast, local vulnerability searches without exposing...

Vuls is an agent-less vulnerability scanner written in Go that detects security vulnerabilities across Linux, FreeBSD, Windows, macOS, containers,...

Clair is a static analysis tool that scans OCI and Docker container images for known vulnerabilities, enabling security teams to assess container...

Snyk CLI is a developer-focused security scanning tool that detects and monitors vulnerabilities across open-source dependencies, application code,...

Brakeman is a static analysis security scanner specifically designed for Ruby on Rails applications, detecting vulnerabilities in Rails code without...

Jaeles is a Go-based Web Application Scanner framework designed for security professionals and bug bounty hunters to build custom vulnerability...

exploit_me is a deliberately vulnerable ARM/AARCH64 application designed as a CTF-style educational tutorial covering 29 exploitation techniques...

is-website-vulnerable is a security scanning tool that detects publicly known vulnerabilities in a website's frontend JavaScript libraries by...

A centralized database of known security vulnerabilities in PHP packages and libraries, maintained as a YAML-based reference that integrates with...