kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the online demo source...

apkvuln

ApkVuln \ / \ / \ / \ / \ /\ \ \ \ /|\ \ \ | | | \ | |/ /\ \ / / | | | | | | | / \ | / ' \ V /| || | || . | // \|| |\ / /|||| С помощью ApkVuln вы получите .java файлы APK, которые будут проанализированы на наличие возможных уязвимостей в коде с использованием регулярных выражений...

ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

checkov

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

awesome-nodejs-security

Список лучших ресурсов по безопасности Node.js. Изучайте безопасные методы и лучшие практики написания кода на Node.js от Лирана Тала Содержание Инструменты Укрепление веб-фреймворков Безопасность GitHub Actions и CI/CD Статический анализ кода Динамическое тестирование безопасности приложений...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

autoSource

AutoSource AutoSource — это автоматизированный фреймворк для анализа исходного кода, интегрированный с SonarQube, способный выполнять статический анализ/рецензирование кода. Он может эффективно находить уязвимости на самых ранних этапах SDLC жизненного цикла разработки программного обеспечения...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

wpbullet

wpBullet Статический анализ кода для плагинов/тем WordPress и PHP Установка Просто клонируйте репозиторий, установите зависимости и запустите скрипт: $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Использование...

StaCoAn

StaCoAn Больше не поддерживается! Скоро будет архивирован. StaCoAn — это кроссплатформенный инструмент, помогающий разработчикам, охотникам за багами и этичным хакерам проводить статический анализ кода мобильных приложений. Этот инструмент будет искать в коде интересные строки, которые могут...

vulnhuntr

LLM과 정적 코드 분석을 사용하여 원격으로 악용 가능한 취약점을 식별하는 도구입니다. 세계 최초로 자율 AI가 발견한 0데이 취약점 설명 Vulnhuntr은 LLM의 힘을 활용하여 원격 사용자 입력에서 시작하여 서버 출력으로 끝나는 전체 코드 호출 체인을 자동으로 생성 및 분석함으로써, 기존 정적 코드 분석 도구가 수행할 수 있는 범위를 훨씬 넘어서는 복잡하고 다단계이며 보안을 우회하는 취약점을 탐지합니다. 모든 0데이에 대한 Vulnhuntr 출력을 포함한 모든 세부 사항은 여기에서 확인하세요: Protect AI...

whispers

Whispers «Мои птички повсюду, даже на Севере, они шепчут мне самые странные истории.» — Лорд Варис Whispers — это инструмент статического анализа кода, предназначенный для разбора различных распространённых форматов данных в поисках жёстко заданных учётных данных и опасных функций. Whispers можно...

static-code-analysis-helper

Static-Code-Analysis-Helper 설명 프로젝트 폴더에 있는 여러 웹 프로그래밍 언어 및 프레임워크에서 공격 방법론을 유발할 가능성이 있는 함수를 탐지합니다. 정적 코드 분석을 수행하는 데 도움을 줍니다. 참고: 여기에 설명된 많은 함수는 취약점을 유발하지 않을 수 있습니다. 스크린샷 프로그래밍 언어 Go Python Ruby PHP JavaScript Java Rust Perl Ruby on Rails Swift Golang Scala Kotlin Julia Dart ASP.NET Core 결과와 관련된 공격...

CVE-2026-28338

PMD is affected in versions prior to 7.22.0 where the legacy report formats vbhtml and yahtml insert rule-violation messages into HTML without escaping, causing potential cross-site scripting if untrusted source code contains crafted strings. The vulnerability does not affect the default html for...

PT-2026-22398

Name of the Vulnerable Software and Affected Versions PMD versions prior to 7.22.0 Description PMD, a static code analyzer, contains a flaw where its vbhtml and yahtml report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted...

Exploit for Generation of Error Message Containing Sensitive Information in Postgresql

This is a PoC exploit for CVE-2021-3393, a Java source code static code analysis and danger function identifier program. The tool, named JavaID, identifies dangerous functions in Java source code by way of regular matching. It targets Java vulnerabilities such as XXE, Java Object Deserialization,...

The vulnerability of the Terraform file processor tool for static code analysis by Prisma Cloud allows a attacker to execute arbitrary code.

The vulnerability of the Terraform file processor tool for static code analysis by Prisma Cloud is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Client-Side Zero-Shot LLM Inference for Comprehensive In-Browser URL Analysis

Malicious websites and phishing URLs pose an ever-increasing cybersecurity risk, with phishing attacks growing by 40% in a single year. Traditional detection approaches rely on machine learning classifiers or rule-based scanners operating in the cloud, but these face significant challenges in...

CVE-2025-23215

PMD Designer’s release signing keys were found with passphrases exposed in Maven Central jars. The two compromised keys (94A5 2756 9CAF 7A47 AFCA BDE4 86D3 7ECA 8C2E 4C5B and EBB2 41A5 45CB 17C8 7FAC B2EB D0BF 1D73 7C9A 1C22) have been revoked; signatures on past artifacts remain valid, and the g...

This Week in Spring - June 18th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've just come from Paris, France, and now I'm in equally beautiful Krakow, Poland, for the amazing Devoxx PL event. We've got a ton of good stuff to dive into, so let's get going! In last week's installment of Spring Tips, I...