Free for Open Source Application Security Tools - OWASP page that lists the Commercial Dynamic Application Security Testing (DAST) tools we know of that are free for Open Source · http://sectooladdict.blogspot.com/ - Web Application Vulnerability Scanner Evaluation Project (WAVSEP)

As part of the commercial vulnerability management product family OPENVAS SCAN, the scanner forms the OPENVAS COMMUNITY EDITION together with other open-source modules.

A list of open source web security scanners on GitHub and GitLab, ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below. Note that some large projects have multiple repos - in which case the second most relevant repo is included immediately after and is indented. ... Tools which can find a range of 'unknown' vulnerabilities on any websites.

July 24, 2025 - While not a dedicated vulnerability scanner like Nessus or Qualys, Nmap’s ability to identify open ports, services, and associated vulnerabilities through its scripts makes it a fundamental tool in any security professional’s toolkit. Invicti is a web application security scanner known for its “proof-based scanning” technology. This feature automatically verifies identified vulnerabilities, helping to eliminate false positives and provide concrete evidence of exploitable flaws. Invicti is designed for accuracy and scalability, making it suitable for organizations with numerous web applications. Nikto is a simple yet effective open-source command-line web server scanner.

Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.

October 31, 2024 - Data Sources: Integrates with APIs from tools like Shodan, VirusTotal, and GitHub, as well as public archives. Deployment Options: Offers CLI, Docker, and prebuilt packages for diverse environments. Amass is widely used for security assessments by pentesters and red teams to identify vulnerabilities across large networks. The MISP Project is an open-source platform for cyber threat intelligence sharing, supporting the analysis and sharing of threat data, malware information, and security incidents.

September 11, 2025 - RSI Security’s code vulnerability scanner supports a wide array of languages and containers to cover the entirety of your code. ... Access our large database of vulnerabilities that constantly aggregates information from the NVSD, security advisories, and open source issue trackers. ... Our OSS scan tool use algorithms that match both quality and security issues of impacted libraries to prevent false positives.

June 12, 2026 - Nmap, OpenVAS, and ZAP lead their respective categories for device and web application vulnerability scanning. Specialty tools such as OSV-Scanner, CloudSploit, and sqlmap address specific use cases including software dependencies, cloud workloads, ...

March 30, 2026 - ... Automated Security Helper (ASH) is a tool that simplifies security assessments in AWS environments. It also integrates open-source scanners like Bandit, Semgrep, and Checkov to detect vulnerabilities in code, IaC templates, and IAM policies.

OSV-Scanner also provides reusable GitHub workflows that can be easily integrated into CI/CD pipelines to provide continuous vulnerability scanning coverage. This can scan newly added dependencies in pull requests for introduced vulnerabilities, as well as perform regular vulnerability scans for the entire project. ... This project is open source...

Trivy is the most popular open source security scanner for Vulnerability &, IaC, SBOM discovery, cloud scanning and Kubernetes security

March 20, 2026 - However, Nmap is a discovery tool, not a full vulnerability management platform. Teams typically feed Nmap output into dedicated scanners like OpenVAS for deeper assessment. ... Extends scanning capabilities with 500+ NSE scripts for basic checks and limited vulnerability detection · Detects service versions for more accurate risk analysis ... Nikto is an open-source command-line web server scanner that performs basic vulnerability assessments across a wide range of web servers.

October 9, 2024 - ... Open source vulnerability scanners, ... tools, are used to detect open source components used in software projects, and check if they contain unpatched security vulnerabilities, and help organizations remediate them....

March 6, 2026 - Note: We’ll only be covering active open-source projects, as some popular tools are no longer maintained or are not under active development (i.e., Anchore Engine, kube-hunter). These container security solutions are dedicated to inspecting container images and identifying known vulnerabilities within them.

Some of the more popular vulnerability scanners are: ... For this example we’ll focus on Grype, since it is easy to use in many different scenarios and supports a variety of ecosystems. Grype is an open source vulnerability scanner that can run on desktop, in CI systems, as a Docker container and scan a wide variety of ecosystems from Linux distributions to many types of build dependency specifications.

2 weeks ago - Acunetix is a vulnerability scanner designed to help organizations identify, validate, and fix security vulnerabilities in their web applications and APIs. By combining automated scanning with built-in validation, it enables security teams to focus on real, exploitable risks rather than chasing false positives. Modern vulnerability scanning tools cover a wide range of systems, from operating systems and open ...

By giving the maintainers of these critical open source codebases access to a new generation of AI models that can proactively identify and fix vulnerabilities at scale, Project Glasswing offers a credible path to changing that equation.

April 14, 2026 - The Code Security Risk Assessment brings that same philosophy to vulnerabilities in your source code. Both assessments now run together from a single entry point, with a tabbed interface that lets you switch between your secret exposure and ...

In today’s digital age, web applications have become necessary for businesses and individuals, but their growing complexity has also achieved prime targets for cyber attacks. Many open source tools such as Owasp Zap, Nikto, and Wapiti exist to ...