cq

cq Code Query, a universal code security scanning tool. CQ scans code for security vulnerabilities and other items of interest to security-focussed code reviewers. It outputs text files containing references to issues found, into an output directory. These output files can then be reviewed,...

aura

.. image:: https://cdn.sourcecode.ai/imgs/logotype.png :target: https://aura.sourcecode.ai/ ====== .. class:: center |homepageflair| |docsflair| |dockerflair| |licenseflair| |travisflair| |pypiflair| Source code auditing and static code analysis Aura is a static analysis framework developed as a...

cve-2020-11023-scanner

💥 CVE-2020-11023 Scanner: Find and Conquer XSS Before It's Too Late! 💥 Are you haunted by the specter of Cross-Site Scripting XSS vulnerabilities lurking in your JavaScript code? Worried about CVE-2020-11023 leaving your web applications open to attack? Fear no more! The CVE-2020-11023 Scanner is...

cerberus-re-skill

Cerberus RE cerberus-re is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida. It is designed for analysts and coding agents that need durable artifacts instead of terminal-only notes: Ghidr...

Sighthound

Sighthound Tree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis. What It Does Scans source code for security issues using AST-aware rules. Supports pattern mode and taint mode source to sink tracking. Handles multi-file projects and parallel execution...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

vulnhuntr

A tool to identify remotely exploitable vulnerabilities using LLMs and static code analysis. World's first autonomous AI-discovered 0day vulnerabilities Description Vulnhuntr leverages the power of LLMs to automatically create and analyze entire code call chains starting from remote user input an...

ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

CVE-2022-41853

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default ...

ContextHound

ContextHound Static analysis tool that scans your codebase for LLM prompt-injection and multimodal security vulnerabilities. Runs offline, no API calls required. The ContextHound ecosystem ContextHound is available across your entire development and browsing workflow: Tool| What it does| Install...

CVE-2025-55182-Scanner

CVE-2025-55182 Hybrid Security Scanner A professional, hybrid security scanner designed to bridge static analysis and dynamic exploitation capabilities for CVE-2025-55182. This tool serves both developers shift-left security and security professionals production testing. Features Static Analysis ...

N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...

Yamcs <=5.11.12 - Arbitrary File Read

Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handle...

Apache Unomi - Remote Code Execution

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code. id: CVE-2020-11975 info: name: Apache Unomi -...

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

WebMvc.fn/WebFlux.fn - Path Traversal

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Solara <1.35.1 - Local File Inclusion

A Local File Inclusion LFI vulnerability was identified in widgetti/solara, in version 1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. ...

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

Labstack Echo 4.8.0 - Open Redirect

Labstack Echo 4.8.0 contains an open redirect vulnerability via the Static Handler component. An attacker can leverage this vulnerability to cause server-side request forgery, making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-400...