Nuclei
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
- Stars
- 32k
- Forks
- 4k
- Last commit
- today
DefectDojo
Vulnerability management and DevSecOps findings platform
Web platform that imports findings from many security scanners, deduplicates them and tracks remediation across products and engagements.
Open sourceBSD-3-Clause
Alternative toQualys VMDR
What DefectDojo does
DefectDojo collects the output of security tools into a single place. It ships parsers for a large number of scanners, deduplicates findings, tracks their status over time and organises them by product, engagement and test.
Teams use it as the reporting and tracking layer of an open-source security programme, often fed automatically from CI through its REST API. It started as an OWASP flagship project; DefectDojo Inc. now leads development and offers a commercial edition alongside the open-source one.
Key features
- Parsers for a large number of security scanners
- Finding deduplication and SLA tracking
- Products, engagements and tests model
- REST API for CI integration
- Jira integration and reporting
Licence
BSD-3-Clause · BSD 3-Clause License · Open source
Open-source edition; DefectDojo Inc. also sells a commercial Pro edition.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: BSD-3-Clause.
Security of DefectDojo itself
78 published advisories for DefectDojo in GitHub repository advisories; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-r83j-v49f-m87mmedium2026-10-12
User account details were readable through an API read path introduced in 3.3.0
GHSA-3wj3-8jhg-3c5qmedium2026-10-12
A rejected edit was partially applied, leaving a record and its displayed value out of step
GHSA-66vh-fm67-46vwmedium2026-09-29
API token remained valid after a forced password reset
GHSA-hm9q-36mr-hg94medium2026-09-29
Scan import error message discloses the organization name of an asset the caller cannot access
GHSA-qj59-6r69-xmgvmedium2026-09-29
Cross-Product Disclosure of Product and Finding Associations Through the Location API Filters and the Vulnerable Endpoint Views
GHSA-x667-22jr-wvmwmedium2026-09-29
Improper Authorization Allows a Product Member Without Delete Permission to Delete Findings Through the Merge Findings Action
GHSA-52xm-5vrx-cqmmmedium2026-09-29
Scan import could write into an asset the caller is not authorized for
GHSA-j635-qvw5-qv7jmedium2026-09-29
Scan import could be directed at an engagement the caller is not authorized for
GHSA-g3w5-c3g8-5gfpmedium2026-09-29
Private notes were readable by other members of the same product through an API read path
GHSA-p43f-52f3-6v3vmedium2026-09-29
Action history for a user account disclosed records from products the caller cannot access
GHSA-9pmx-7vc8-r7xwmedium2026-09-29
Action history of a shared Location disclosed another product's request context
GHSA-fhpm-fp42-h465medium2026-09-29
Finding details remain visible in engineer metrics after a user's product access is revoked
Sources: GitHub repository advisories · checked 2026-10-20.
Categories and tags
Vulnerability scanningDependencies and SBOM (SCA)#vulnerability-management#aspm#django#owasp#python#vulnerability-databases#security#analytics
Related tools
OpenVAS (Greenbone)
Network vulnerability scanner (Greenbone Community Edition)
Scanner engine of the Greenbone Community Edition, running network vulnerability tests from the Greenbone community feed against hosts and services.
- Stars
- 4.9k
- Forks
- 805
- Last commit
- today
Nikto
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
- Stars
- 11k
- Forks
- 1.5k
- Last commit
- 2 months ago
Alternative toAcunetix
Dependency-Track
Continuous SBOM analysis platform
OWASP platform that ingests CycloneDX SBOMs and continuously tracks component risk, vulnerabilities and licence policy across a whole portfolio.
- Stars
- 4.3k
- Forks
- 832
- Last commit
- today
Metasploit Framework
Penetration testing framework
Rapid7's open-source framework for developing, testing and running exploit modules and auxiliary checks in authorised security assessments.
- Stars
- 39k
- Forks
- 15k
- Last commit
- today
Trivy
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
- Stars
- 39k
- Forks
- 776
- Last commit
- today