The SpotBugs plugin for security audits of Java web applications
The OWASP ZAP core project
SonarSource Static Analyzer for Java Code Quality and Security
Web and mobile application security awareness/training platform
Open Source Penetration Testing / Ethical Hacking Framework