checkov

...

StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

awesome-nodejs-security

A curated list of awesome Node.js Security resources. Learn Node.js Secure Coding techniques and best practices from Liran Tal Contents Tools Web Framework Hardening Static Code Analysis Dynamic Application Security Testing Input/Output Validation Secure Composition...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the...

vulnhuntr

LLMと静的コード解析を使用して、リモートで悪用可能な脆弱性を特定するツールです。 世界初の自律型AIが発見した0day脆弱性 説明 Vulnhuntrは、LLMの力を活用して、リモートのユーザー入力から始まりサーバー出力に至るコード呼び出しチェーン全体を自動的に作成・分析し、従来の静的コード解析ツールの能力をはるかに超える、複雑で多段階のセキュリティ回避型脆弱性を検出します。すべての0dayに対するVulnhuntrの出力を含む詳細はこちら: Protect AI Vulnhuntr Blog 発見された脆弱性 !TIP Vulnhuntrを使用して脆弱性を発見しましたか？...

ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

wpbullet

wpBullet WordPressプラグイン/テーマ（およびPHP）の静的コード解析 インストール リポジトリをクローンし、依存関係をインストールしてスクリプトを実行します $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py 使い方 利用可能なオプション: root@kitploit: --path 必須 システムパスまたはダウンロードURL 例:...

autoSource

AutoSource AutoSource is an automated source code review framework integrated with SonarQube which is capable of performing static code analysis/reviews. It can be used for effectively finding the vulnerabilities at very early stage of the SDLCSoftware Development Life Cycle. The user can scan th...

apkvuln

ApkVuln root@kitploit: \ / \ / \ / \ / \ /\ \ \ \ /|\ \ \ | | | \ | |/ /\ \ / / | | | | | | | / \ | / ' \ V /| || | || . | // \|| |\ / /|||| With ApkVuln you will obtain the .java files of an APK and they will be analyzed in search of possible vulnerabilities in the code, for it will make...

static-code-analysis-helper

Static-Code-Analysis-Helper 描述 它可以检测项目文件夹中许多 Web 编程语言和框架中可能被用于攻击方法的函数。 帮助你执行静态代码分析。 注意：这里描述的许多函数可能并不会导致漏洞。 截图 编程语言 Go Python Ruby PHP JavaScript Java Rust Perl Ruby on Rails Swift Golang Scala Kotlin Julia Dart ASP.NET Core 与结果相关的攻击类型 SQLi、XSS、XXE、CSRF、SSTI、SSRF、IDOR、CORS、XSHM、LFI、DoS、DDoS、RFI、弱加...

whispers

Whispers "My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or...

CVE-2026-28338

PMD is affected in versions prior to 7.22.0 where the legacy report formats vbhtml and yahtml insert rule-violation messages into HTML without escaping, causing potential cross-site scripting if untrusted source code contains crafted strings. The vulnerability does not affect the default html for...

PT-2026-22398

Name of the Vulnerable Software and Affected Versions PMD versions prior to 7.22.0 Description PMD, a static code analyzer, contains a flaw where its vbhtml and yahtml report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted...

Exploit for Generation of Error Message Containing Sensitive Information in Postgresql

This is a PoC exploit for CVE-2021-3393, a Java source code static code analysis and danger function identifier program. The tool, named JavaID, identifies dangerous functions in Java source code by way of regular matching. It targets Java vulnerabilities such as XXE, Java Object Deserialization,...

Client-Side Zero-Shot LLM Inference for Comprehensive In-Browser URL Analysis

Malicious websites and phishing URLs pose an ever-increasing cybersecurity risk, with phishing attacks growing by 40% in a single year. Traditional detection approaches rely on machine learning classifiers or rule-based scanners operating in the cloud, but these face significant challenges in...

CVE-2025-23215

PMD Designer’s release signing keys were found with passphrases exposed in Maven Central jars. The two compromised keys (94A5 2756 9CAF 7A47 AFCA BDE4 86D3 7ECA 8C2E 4C5B and EBB2 41A5 45CB 17C8 7FAC B2EB D0BF 1D73 7C9A 1C22) have been revoked; signatures on past artifacts remain valid, and the g...

This Week in Spring - June 18th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've just come from Paris, France, and now I'm in equally beautiful Krakow, Poland, for the amazing Devoxx PL event. We've got a ton of good stuff to dive into, so let's get going! In last week's installment of Spring Tips, I...

libssh security update

0.9.6-14 - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol BPP - Fix CVE-2023-6918 Missing checks for return values for digests - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection of malicious code through hostname - Note: version is bumped from 12 to 14...