Open-source vulnerability-scanning software

450 open-source libraries, tools and applications tagged vulnerability-scanning, ranked by how closely vulnerability-scanning is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.

450 products, primary matches first, then adoption-weighted; health v2 shown.

Product	Health v2	Stars	Maturity
Z4nzu/hackingtool An all-in-one, menu-driven Python toolkit that aggregates 215 curated security testing tools across 21 categories such as recon, OSINT, web…	73	80077	active
Metasploit Framework Metasploit Framework is an open-source penetration testing platform written in Ruby. It provides a collection of exploits, payloads, and au…	75	39058	active
sqlmap sqlmap is an open‑source command‑line tool that automates detection and exploitation of SQL injection flaws. It can fingerprint databases, …	72	38549	active
Trivy Trivy is an open‑source command‑line security scanner that detects vulnerabilities, misconfigurations, secrets, licenses and generates SBOM…	98	38274	active
Nuclei Nuclei is a fast, open-source vulnerability scanner built on a simple YAML-based template DSL, maintained by ProjectDiscovery. It uses a la…	96	32091	active
TruffleHog TruffleHog is an open-source secrets scanning tool that discovers, classifies, validates, and analyzes leaked credentials across Git reposi…	93	28212	active
cloudflare/security-audit-skill A coding-agent skill from Cloudflare that turns an LLM coding agent into a security auditor via a six-phase pipeline (recon, hunting, valid…	56	26974	active
MobSF/Mobile-Security-Framework-MobSF MobSF is an automated all-in-one mobile application security testing framework for Android, iOS, and Windows Mobile apps. It performs stati…	94	21980	active
NVIDIA/SkillSpector SkillSpector is a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and MCP-based agents. It detects vulnera…	79	18115	active
Lynis Lynis is an open-source security auditing and hardening tool for UNIX-based systems including Linux, macOS, and BSD. It performs in-depth l…	83	16450	stable
Zed Attack Proxy (ZAP) Zed Attack Proxy (ZAP) by Checkmarx is a free, open-source web application security scanner used for finding vulnerabilities in web apps du…	74	15865	stable
Prowler Prowler is an open-source cloud security platform that performs security best-practice assessments, audits, continuous monitoring, hardenin…	93	14863	active
shadow1ng/fscan Fscan is a comprehensive intranet scanning tool written in Go that automates host discovery, port scanning, service identification, weak-pa…	91	14590	active
awslabs/git-secrets git-secrets is a command-line tool that scans git commits, commit messages, and merge histories for secrets and credentials, rejecting comm…	48	13411	stable
threat9/routersploit RouterSploit is an open-source exploitation framework dedicated to embedded devices like routers, modeled after Metasploit. It provides mod…	55	13256	active
anchore/grype Grype is an open-source vulnerability scanner for container images, filesystems, and SBOMs, written in Go by Anchore. It identifies known C…	98	12985	active
future-architect/vuls Vuls is an agent-less vulnerability scanner written in Go that detects CVEs on Linux, FreeBSD, Windows, macOS, containers, WordPress, progr…	98	12284	active
Kubescape Kubescape is an open-source Kubernetes security platform (a CNCF incubating project) offering misconfiguration scanning, vulnerability asse…	100	11815	active
chaitin/xray xray is a security assessment tool from Chaitin that scans web applications for common vulnerabilities like XSS and SQL injection, supporti…	23	11752	active
1N3/Sn1per Sn1per is an open-source automated penetration testing and attack surface management platform that chains reconnaissance, scanning, exploit…	60	11373	active
google/osv-scanner OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across ma…	99	11184	active
openai/codex-security OpenAI's Codex Security is a CLI and TypeScript SDK that uses AI to find, validate, and fix security vulnerabilities in codebases. It suppo…	81	11143	active
quay/clair Clair is an open-source service for static analysis of vulnerabilities in container images (OCI and Docker). It indexes image contents via …	71	11065	active
sullo/nikto Nikto is a Perl-based command-line web server scanner that tests servers for dangerous files, outdated software, misconfigurations, and kno…	86	10747	active
projectdiscovery/httpx httpx is a fast, multi-purpose HTTP toolkit written in Go that runs multiple probes (status codes, titles, TLS certificates, tech detection…	94	10500	active
CodeQL CodeQL is a semantic code analysis engine that treats code as a queryable database, letting you write queries to find security vulnerabilit…	77	10201	active
wpscanteam/wpscan WPScan is a black-box WordPress security scanner written in Ruby, used by security professionals and site maintainers to audit WordPress in…	90	9792	active
docker/docker-bench-security Docker Bench for Security is a shell script that automates checks of Docker hosts and containers against the CIS Docker Benchmark best prac…	57	9703	active
NVIDIA/garak garak is a command-line LLM vulnerability scanner that probes large language models for failures like hallucination, data leakage, prompt i…	89	9332	active
testssl/testssl.sh testssl.sh is a free, bash-based command line tool that checks any server's service on any port for TLS/SSL cipher, protocol, and cryptogra…	85	9218	active
frohoff/ysoserial ysoserial is a proof-of-concept command-line tool that generates serialized Java payloads exploiting unsafe object deserialization using ga…	44	9088	active
Checkov Checkov is a static code analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and more) that …	94	9060	stable
securego/gosec gosec is a security scanner for Go source code that inspects the AST and SSA representations to detect common security problems. It include…	92	8961	active
yogeshojha/rengine reNgine is a self-hosted automated web reconnaissance and vulnerability scanning framework with configurable recon engines, data correlatio…	66	8869	active
Tsunami Security Scanner Tsunami is a general-purpose network security scanner from Google that detects high-severity vulnerabilities with high confidence. It relie…	75	8620	active
PyCQA/bandit Bandit is a security-oriented static analysis tool that finds common security issues in Python code. It parses each file into an AST, runs …	82	8285	active
aquasecurity/kube-bench kube-bench is a Go-based tool that checks whether Kubernetes clusters are deployed securely by running the checks documented in the CIS Kub…	95	8216	active
vercel-labs/deepsec Deepsec is an open-source, agent-powered vulnerability scanner that runs AI coding agents over your entire existing codebase to find hard-t…	58	8075	active
Scout Suite Scout Suite is an open source multi-cloud security auditing tool that assesses the security posture of cloud environments. It gathers confi…	39	7824	stable
yaklang/yakit Yakit is an all-in-one interactive application security testing platform built as a GUI client for the Yaklang security DSL engine over gRP…	93	7786	active
OWASP Dependency-Check OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project…	96	7723	active
apache/caldera Apache Caldera is a cybersecurity platform for automated adversary emulation built on the MITRE ATT&CK framework. It provides an asynchrono…	75	7317	active
presidentbeef/brakeman Brakeman is a free, open-source static analysis security scanner built specifically for Ruby on Rails applications. It analyzes Rails sourc…	90	7273	stable
lintsinghua/DeepAudit DeepAudit is an open-source multi-agent AI system for automated code vulnerability discovery and security auditing, with a React frontend a…	72	7178	active
ayoubfaouzi/al-khaser Al-Khaser is a proof-of-concept Windows application that demonstrates a wide range of malware anti-analysis techniques, including anti-debu…	67	7141	active
Tencent/AI-Infra-Guard Tencent's full-stack AI red teaming platform that scans AI infrastructure, agents, MCP servers, and skills for vulnerabilities and evaluate…	85	6916	active
Faraday Faraday is an open-source vulnerability management platform that aggregates, normalizes, and deduplicates findings from over 90 security to…	98	6781	active
ticarpi/jwt_tool A Python command-line toolkit for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It automates checks for known J…	28	6770	active
zizmor zizmor is a static analysis tool for CI/CD configurations, primarily GitHub Actions workflows, as well as Dependabot and pre-commit configs…	87	6714	active
The-Z-Labs/linux-exploit-suggester A shell-based auditing tool that assesses a Linux system's exposure to publicly known kernel privilege escalation exploits based on kernel …	62	6626	active
Gitleaks Gitleaks is an open-source CLI tool for detecting secrets like passwords, API keys, and tokens in git repositories, files, directories, and…	87	29941	maintenance
crytic/slither Slither is a Python-based static analysis framework for Solidity and Vyper smart contracts. It runs vulnerability detectors, prints contrac…	90	6374	active
dwisiswant0/apkleaks APKLeaks is a Python CLI tool that decompiles Android APK files with jadx and scans them for URIs, endpoints, and hardcoded secrets using r…	36	6344	active
Bjorn Bjorn is an autonomous network scanning and offensive security tool that runs on a Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers …	58	6328	active
anthropics/claude-code-security-review A GitHub Action that uses Anthropic's Claude to perform AI-powered security reviews of pull requests, analyzing code diffs for vulnerabilit…	45	6319	active
k8gege/K8tools K8tools is a large curated collection of penetration testing and offensive security tools covering internal network penetration, privilege …	32	6234	active
GhostTroops/scan4all scan4all is a Go-based automated vulnerability scanning and reconnaissance tool that integrates vscan, nuclei, ksubdomain, and subfinder. I…	23	6178	active
commix Commix (short for command injection exploiter) is an open-source penetration testing tool that automates the detection and exploitation of …	72	5874	active
OpenSSF Scorecard OpenSSF Scorecard is an automated tool that scores open source projects on security best practices through a series of checks. It can be ru…	91	5761	active
Snyk CLI The Snyk CLI is a command-line tool that scans projects for security vulnerabilities across open-source dependencies, application code, con…	97	5668	active
OWASP/Nettacker OWASP Nettacker is a Python-based automated penetration testing and information-gathering framework for reconnaissance, vulnerability scann…	84	5616	active
google/clusterfuzz ClusterFuzz is Google's scalable fuzzing infrastructure that finds security and stability bugs in software, serving as the backend for OSS-…	95	5613	active
Ladon Ladon is a large-scale internal network penetration scanner written in C#, offering port scanning, service identification, network asset di…	25	5333	active
hahwul/dalfox Dalfox is an open-source XSS vulnerability scanner written in Rust that automates discovery, injection, and DOM/AST-level verification of r…	99	5326	active
ThreatMapper Deepfence ThreatMapper is an open-source Cloud Native Application Protection Platform (CNAPP) that hunts threats in production cloud, Kuber…	78	5324	active
Awarexone/Agentic-Bug-Hunter An AI-powered bug bounty hunting toolkit that automates reconnaissance, vulnerability testing, finding validation, and report generation fo…	75	5294	active
perplexityai/bumblebee Bumblebee is a read-only Go CLI that scans developer endpoints for on-disk package, extension, and developer-tool metadata (lockfiles, pack…	74	5038	active
V4bel/dirtyfrag Dirty Frag is a proof-of-concept Linux kernel local privilege escalation exploit written in C. It chains the xfrm-ESP (CVE-2026-43284) and …	47	5018	active
bitsadmin/wesng WES-NG is a Python command-line tool that parses Windows `systeminfo` output (or missing KB listings) and cross-references it against a reg…	76	4951	active
Greenbone Community Edition OpenVAS Scanner is the scan engine of the Greenbone Community Edition, executing a continuously updated feed of vulnerability tests against…	95	4868	active
charles2gan/GDA-android-reversing-Tool GDA (GJoy Dex Analyzer) is a fast, native C++ Dalvik bytecode decompiler and reverse analysis platform for Android binaries such as APK, DE…	64	4852	active
cdk-team/CDK CDK is a zero-dependency container penetration toolkit written in Go for security testing of Kubernetes, Docker, and Containerd environment…	64	4767	active
microsoft/PyRIT PyRIT is Microsoft's open-source Python framework for identifying security and safety risks in generative AI systems. It provides automatio…	88	4664	active
detect-secrets detect-secrets is a Python CLI tool from Yelp that detects secrets (API keys, passwords, tokens) in codebases using regex and entropy heuri…	53	4649	active
zan8in/afrog afrog is an open-source security tool written in Go for vulnerability scanning using PoC (Proof of Concept) rules. It is designed for bug b…	99	4431	active
TideSec/TscanPlus TscanPlus is a comprehensive network security detection and operations tool for rapid asset discovery, identification, and vulnerability de…	92	4407	active
jtesta/ssh-audit ssh-audit is a Python CLI tool that audits SSH server and client configurations, analyzing banners, key exchange, encryption, MAC, and comp…	83	4324	active
ConsenSysDiligence/mythril Mythril is a symbolic-execution-based security analysis tool for EVM bytecode that detects vulnerabilities in Ethereum and other EVM-compat…	55	4272	active
OWASP Dependency-Track OWASP Dependency-Track is an open-source component analysis platform that ingests CycloneDX SBOMs to continuously identify vulnerabilities,…	99	4269	active
RetireJS/retire.js Retire.js is a scanner that detects the use of JavaScript libraries and Node.js modules with known vulnerabilities, available as a CLI scan…	95	4180	active
theori-io/copy-fail-CVE-2026-31431 A proof-of-concept exploit for CVE-2026-31431, a Linux kernel local privilege escalation bug in the authencesn cryptographic template that …	47	4075	active
itm4n/PrivescCheck A PowerShell enumeration script that identifies common Windows privilege escalation vulnerabilities and misconfigurations. It also collects…	98	3987	active
speed47/spectre-meltdown-checker A self-contained shell script that checks Linux and BSD systems for vulnerability to transient execution CPU vulnerabilities such as Spectr…	96	3951	active
Pocsuite pocsuite3 is an open-source remote vulnerability testing and proof-of-concept development framework by Knownsec's 404 Team. It provides a P…	23	3876	active
trimstray/htrace.sh htrace.sh is a shell-script CLI that combines HTTP/HTTPS request troubleshooting (redirect tracing, headers, body, SSL parameters, custom m…	32	3862	active
pwntester/ysoserial.net ysoserial.net is a proof-of-concept command-line tool that generates deserialization payloads exploiting unsafe .NET object deserialization…	65	3793	active
edoardottt/cariddi Cariddi is a fast command-line web crawler written in Go that takes a list of domains, crawls URLs, and scans for endpoints, secrets, API k…	84	3786	active
scipag/vulscan Vulscan is an Nmap NSE script that turns Nmap into a vulnerability scanner by matching version-detected services against offline vulnerabil…	49	3786	active
nabla-c0d3/sslyze SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes a server's TLS configuration, including certificates, cipher suites…	77	3780	stable
aquasecurity/cloudsploit CloudSploit by Aqua is an open-source Cloud Security Posture Management (CSPM) tool that scans cloud infrastructure accounts for misconfigu…	66	3777	active
ly4k/Certipy Certipy is a Python CLI toolkit for enumerating and abusing Active Directory Certificate Services (AD CS) misconfigurations. It detects and…	88	3702	active
EMBA EMBA is an open-source firmware security analyzer for embedded Linux devices, written in Bash. It automates firmware extraction, static and…	94	3701	active
s0md3v/XSStrike XSStrike is a Python command-line Cross Site Scripting (XSS) detection suite that uses hand-written HTML/JavaScript parsers, context analys…	27	15197	maintenance
vulnersCom/nmap-vulners A collection of Nmap NSE scripts that enrich service scans with CVEs, CVSS scores and known exploits from the Vulners database. It fingerpr…	96	3494	active
google/honggfuzz Honggfuzz is a security-oriented, feedback-driven evolutionary fuzzer that uses software and hardware code coverage to discover bugs in bin…	66	3397	active
almandin/fuxploider Fuxploider is an open-source penetration testing tool that automates detection and exploitation of file upload form vulnerabilities. It ide…	28	3332	active
chipsec/chipsec CHIPSEC is a Python framework for analyzing the security of PC platforms, including hardware, system firmware (BIOS/UEFI), and platform com…	98	3314	active
goodwithtech/dockle Dockle is a container image linter written in Go that checks Docker images against security best practices and CIS Benchmarks. It runs as a…	63	3298	active
techgaun/github-dorks A Python CLI tool that automates GitHub code searches using a curated list of dorks to find leaked secrets like credentials, private keys, …	66	3287	active
rtcatc/Packer-Fuzzer Packer Fuzzer is a Python-based security scanner that targets websites built with JavaScript module bundlers like Webpack. It automatically…	23	3250	active