vulnerabilities

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

🧵 CLI tool for directly patching container images!

Metarget is a framework providing automatic constructions of vulnerable infrastructures.

A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB.

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

Collection of npm package manager Security Best Practices

Automatically Collect POC or EXP from GitHub by CVE ID.

Security advisory database for Rust crates published through crates.io

Very vulnerable ARM/AARCH64 application (CTF style exploitation tutorial with 29 vulnerability techniques)

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

Repository for information about 0-days exploited in-the-wild.

A vulnerable version of Rails that follows the OWASP Top 10

Advisories, proof of concept files and exploits that have been made public by @pedrib.

Zip Slip Vulnerability (Arbitrary file write through archive extraction)

Vulnerability (CVE) scanner for Nix/NixOS [maintainer=@henrirosten]

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

Vulnerabilities of Goby supported with exploitation.

scalpel是一款命令行漏洞扫描工具，支持深度参数注入，拥有一个强大的数据解析和变异算法，可以将常见的数据格式（json, xml, form等）解析为树结构，然后根据poc中的规则，对树进行变异，包括对叶子节点和树结构 的变异。变异完成之后，将树结构还原为原始的数据格式。

An example C program which contains vulnerable code for common types of vulnerabilities. It can be used to show fuzzing concepts.

Integrates Dependency-Check reports into SonarQube

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

A Collection of Vulnerabilities in ERC20 Smart Contracts With Tokens Affected

🧹 Cleaning up images from Kubernetes nodes

Performing security tests inside your CI

VULNRΞPO - Free vulnerability report generator and repository, end-to-end encrypted! Templates of issues, CWE,CVE,MITRE ATT&CK,PCI DSS, import Nmap/Nessus/Burp/OpenVAS/Bugcrowd/Trivy, Jira export, TXT/JSON/MARKDOWN/HTML/DOCX, attachments, automatic changelog, stats, vulnerability management, bugbounty, local ai/llm, super fast pentest reporting!

Bugcrowd’s baseline priority ratings for common security vulnerabilities

ClusterFuzzLite - Simple continuous fuzzing that runs in CI.

S2E: A platform for multi-path program analysis with selective symbolic execution.

Detect, analyze and uniquely identify crashes in Windows applications