Search Results for "vulnerability"
Sort By:
Showing 47 open source projects for "vulnerability"
View related business solutions-
MongoDB Atlas runs apps anywhereMongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
-
Our Free Plans just got better! | Auth0You asked, we delivered! Auth0 is excited to expand our Free and Paid plans to include more options so you can focus on building, deploying, and scaling applications without having to worry about your security. Auth0 now, thank yourself later.
-
1
RedSun
The Red Sun vulnerability repository
...It highlights flaws in endpoint protection logic and emphasizes how race conditions and file system interactions can be abused. The project is not designed as a full framework but as a focused demonstration of a real-world vulnerability. It serves as a stark example of how defensive systems can be turned into attack vectors. -
2
Copy Fail - CVE-2026-31431
epository that demonstrates and analyzes a Linux kernel vulnerability
Copy Fail - CVE-2026-31431 is a proof-of-concept repository that demonstrates and analyzes a specific Linux kernel vulnerability identified as CVE-2026-31431. The project provides experimental scripts and documentation to reproduce and study the exploit in controlled environments. It is designed for security researchers and engineers who want to understand the mechanics of the vulnerability. The repository includes tested configurations across multiple Linux distributions and kernel versions. ... -
3
Kubernetes DNS
Kubernetes DNS service
This is the repository for Kubernetes DNS(kube-dns and nodelocaldns). Vulnerability patches are mainly for debian-base or debian-iptables images. They can be updated to the latest by modifying rules.mk and dnsmasq Makefile. -
4
DefectDojo
DefectDojo is a DevSecOps and vulnerability management tool
DefectDojo is a security orchestration and vulnerability management platform. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings to systems like JIRA and Slack. DefectDojo enriches and refines vulnerability data using a number of heuristic algorithms that improve with the more you use the platform. -
AI-powered service management for IT and enterprise teamsGive your IT, operations, and business teams the ability to deliver exceptional services—without the complexity. Maximize operational efficiency with refreshingly simple, AI-powered Freshservice.
-
5
Anthropic Cybersecurity Skills
754 structured cybersecurity skills for AI agents
Anthropic Cybersecurity Skills is a collection of structured prompts, tools, and workflows designed to enhance the cybersecurity capabilities of AI systems. It focuses on defining reusable “skills” that guide AI models in performing tasks such as vulnerability analysis, threat detection, and security auditing. The project is intended for experimentation and development of AI-assisted cybersecurity workflows, providing templates that can be adapted to different environments. It emphasizes structured interaction patterns, ensuring that outputs are consistent and actionable. The repository also encourages modularity, allowing individual skills to be combined into larger security pipelines. ... -
6
Arduino IDE
Arduino IDE library
...This new IDE was developed with the goal of preserving the same interface and user experience of the previous major version in order to provide a frictionless upgrade. If you need assistance, see the Help Center and browse the forum. If you think you found a vulnerability or other security-related bug in this project, please read our security policy and report the bug to our Security Team. The builds are generated every day at 03:00 GMT from the main branch and should be considered unstable. -
7
Trivy Operator
Kubernetes-native security toolkit
...The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API. The Operator does this by watching Kubernetes for state changes and automatically triggering security scans in response. For example, a vulnerability scan is initiated when a new Pod is created. This way, users can find and view the risks that relate to different resources in a Kubernetes-native way. The Trivy Operator automatically generates and updates security reports. These reports are generated in response to new workload and other changes on a Kubernetes cluster. -
8
Harbor
An open source trusted cloud native registry project that stores
Harbor is an open-source trusted cloud native registry project that stores, signs, and scans content. Harbor extends the open-source Docker Distribution by adding the functionalities usually required by users such as security, identity and management. Having a registry closer to the build-and-run environment can improve the image transfer efficiency. Harbor supports replication of images between registries, and also offers advanced security features such as user management, access control... -
9
Trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers
...Are you a Trivy fan as well? We’d love to hear from you! Trivy detects vulnerabilities from a wide array of operating systems and programming languages, across different versions, and vulnerability sources. Detect common misconfigurations with Trivy, using the same familiar tool and workflow that you already have in place for vulnerabilities. Trivy scans Terraform, CloudFormation, Docker, Kubernetes, and many other IaC configuration files for security issues right alongside vulnerabilities. Trivy IaC is brought to you by the team behind the popular tfsec project. ... -
Ship Agents FasterGemini Enterprise Agent Platform lets you rapidly build, scale, govern and optimize production-ready agents grounded in your organization's data. The platform enables developers to build custom or pre-built agents for virtually any use case. New customers get $300 in free credits.
-
10
Woke
Woke is a Python-based development and testing framework for Solidity
Woke is a Python-based development and testing framework for Solidity. A testing framework for Solidity smart contracts with Python-native equivalents of Solidity types and blazing-fast execution. A property-based fuzzer for Solidity smart contracts that allows testers to write their fuzz tests in Python. See examples and documentation for more information. Fuzzer builds on top of the testing framework and allows efficient fuzz testing of Solidity smart contracts. Woke implements an LSP... -
11
GitLab
Please open new issues in our issue tracker on GitLab
GitLab is a single-application DevOps platform that brings source control, CI/CD, package registries, security scanning, and deployment pipelines under one roof to accelerate software delivery. Built around Git repositories and merge-request workflows, it tightly integrates continuous integration, automated testing, code review, and release orchestration so teams can move from idea to production within a unified UI and policy model. GitLab’s features extend into the operational... -
12
Joern
Open-source code analysis platform for C/C++/Java/Binary/Javascript
...This allows code to be mined using search queries formulated in a Scala-based domain-specific query language. Joern is developed with the goal of providing a useful tool for vulnerability discovery and research in static program analysis. -
13
KubeClarity
KubeClarity is a tool for detection and management of vulnerabilities
KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. It scans both runtime K8s clusters and CI/CD pipelines for enhanced software supply chain security. Effective vulnerability scanning requires an accurate Software Bill Of Materials (SBOM) detection. KubeClarity includes a CLI that can be run locally and especially useful for CI/CD pipelines. It allows to analyze images and directories to generate SBOM, and scan it for vulnerabilities. The results can be exported to KubeClarity backend. -
14
Clair
Vulnerability Static Analysis for Containers
Clair is an application for parsing image contents and reporting vulnerabilities affecting the contents. This is done via static analysis and not at runtime. Clair v4 utilizes the ClairCore library as its engine for examining contents and reporting vulnerabilities. At a high level you can consider Clair a service wrapper to the functionality provided in the ClairCore library. The main branch may be in an unstable or even broken state during development. Please use releases instead of the... -
15
Slither
Static Analyzer for Solidity
Slither is a Solidity static analysis framework written in Python 3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses. Slither is the first open-source static analysis framework for Solidity. Slither is fast and precise; it can find real vulnerabilities in a few seconds without user intervention. ... -
16
The Optimism Monorepo
Optimism is Ethereum, scaled
Optimism is a low-cost and lightning-fast Ethereum L2 blockchain, but it's also so much more than that. Optimism is the technical foundation for the Optimism Collective, a band of communities, companies, and citizens united by a mutually beneficial pact to adhere to the axiom of impact=profit — the principle that positive impact to the collective should be rewarded with profit to the individual. We're trying to solve some of the most critical coordination failures facing the crypto ecosystem... -
17
NGINX Admin’s Handbook
How to improve NGINX performance, security, and other important things
nginx-admins-handbook is a practical, in-depth guide for configuring, securing, and operating NGINX across real-world deployments. It distills years of research, notes, and field experience into a single handbook that complements the official docs with concrete rules, explanations, and curated external references. The handbook spans fundamentals and advanced topics alike, from HTTP and SSL/TLS basics to reverse proxy patterns, performance tuning, debugging workflows, and hardening... -
18
Capslock
Tool to remap Caps Lock key behavior on Windows systems
Capslock is a command-line tool for analyzing the capabilities of Go packages to reveal what privileged operations their code and dependencies can perform. Rather than detecting vulnerabilities, Capslock focuses on identifying capabilities — permissions implied by calls to sensitive or privileged standard library functions, such as file system access, networking, or process control. By following transitive call graphs, it classifies which security-sensitive operations each package can reach,... -
19
OWASP Find Security Bugs
The SpotBugs plugin for security audits of Java web applications
The SpotBugs plugin for security audits of Java web applications. Find Security Bugs is the SpotBugs plugin for security audits of Java web applications. It can detect 141 different vulnerability types with over 823 unique API signatures. Cover popular frameworks including Spring-MVC, Struts, Tapestry and many more. Plugins are available for Eclipse, IntelliJ / Android Studio and NetBeans. Command line integration is available with Ant and Maven. Can be used with systems such as Jenkins and SonarQube. Extensive references are given for each bug patterns with references to OWASP Top 10 and CWE. -
20
K8tools
Security- and exploitation-oriented utilities and proof-of-concepts
K8tools is a large, curated GitHub repository collecting dozens (hundreds) of security- and exploitation-oriented utilities, proof-of-concepts, and payloads aimed at penetration testing, privilege escalation, and vulnerability exploitation. The project bundles exploits for many well-known CVEs, remote get-shell scripts, local privilege-escalation helpers, credential-harvesting utilities, scanning and brute-force tools, and a variety of platform-specific binaries and archives organized into folders for quick browsing. The README and repository metadata present it as an “all-in-one” toolkit for offensive security tasks, with many archived executables, exploit payloads, and helper scripts (including PowerShell and Python examples) that target services such as WebLogic, Tomcat, Zimbra, Struts2, Zabbix and others. ... -
21
Parsedown
Better markdown parser in PHP
...In both cases you should strongly consider employing defence-in-depth measures, like deploying a Content-Security-Policy (a browser security feature) so that your page is likely to be safe even if an attacker finds a vulnerability in one of the first lines of defence. Safe mode does not necessarily yield safe results when using extensions to Parsedown. Extensions should be evaluated on their own to determine their specific safety against XSS. -
22
SSRFmap
Automatic SSRF fuzzer and exploitation tool
...Because SSRF often leads to lateral movement or internal network access, SSRFmap is especially useful for red-teamers and pentesters who want to explore chains rather than just the vulnerability surface. The repository also demonstrates a pragmatic mindset; rather than just “find SSRF”, it tries to “exploit SSRF” for impact, helping security testers build full end-to-end workflows. -
23
OpenRewrite
Automated mass refactoring of source code
The OpenRewrite project is a mass source code refactoring ecosystem. Reduce 1000s of hours of static code analysis fixes to minutes. Turn a four-month migration project into four hours of work. Patch security vulnerabilities across 100s of repositories at once. OpenRewrite automates code refactoring and remediation tasks for you, enabling developers to deliver more business value. OpenRewrite's refactoring engine and recipes will always be open-source. Build tool plugins like OpenRewrite... -
24
Wapiti
Wapiti is a web-application vulnerability scanner
Wapiti is a vulnerability scanner for web applications. It currently search vulnerabilities like XSS, SQL and XPath injections, file inclusions, command execution, XXE injections, CRLF injections, Server Side Request Forgery, Open Redirects... It use the Python 3 programming language. -
25
TRAK Viewpoints
Specifications for TRAK architecture views
The architecture viewpoints (specifications for architecture views iaw ISO 42010) for TRAK. TRAK is a general systems-thinkers'/system engineering enterprise architecture framework. It is simple, user-friendly, pragmatic and not limited to IT. 100% triple-centric and semantically-sound. Defines a total of 24 viewpoints. The ones needed are selected by taking the task sponsor's concerns and matching them to the typical concerns that each TRAK viewpoint addresses. The triples that address...
