cwe 开源项目推荐（282 个）

MobSF /Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) 是一个自动化的一体化移动应用（Android/iOS/Windows）渗透测试、恶意软件分析和安全评估框架，能够执行静态和动态分析。

find-sec-bugs /find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

fkie-cad /cwe_checker

cwe_checker finds vulnerable patterns in binary executables

toolswatch /vFeed

The Correlated CVE Vulnerability And Threat Intelligence Database API

KTZgraph /sarenka

OSINT 工具——在一个应用中从 Shodan、Censys 等服务获取数据

Galeax /CVE2CAPEC

从CVE列表生成MITRE AT&CK和D3FEND。包含CVE、CWE、CAPEC、MITRE ATT&CK D3FEND和ATLAS技术数据的数据库每日更新。在2025年BlackHat Europe Arsenal展会上亮相。

reconmap /pentest-reports

Collection of penetration test reports and pentest report templates. Published by the the best security companies in the world.

Hainrixz /cyber-neo

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 categories. 11 security domains, 60+ secret patterns, parallel subagent analysis, professional report generation. Built by tododeia.com

Feysh-Group /corax-community

Corax for Java: A general static analysis framework for java code checking.

Vulnogram /Vulnogram

Vulnogram is the tool for reserving, managing, and publishing CVEs. Get started at vulnogram.org or deploy Docker edition for full enterprise features.

Agent-Field /sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.

Patrowl /PatrowlHearsData

Open-Source Vulnerability Intelligence Center - Unified source of vulnerability, exploit and threat Intelligence feeds

jeemok /better-npm-audit

The goal of this project is to provide additional features on top of the existing npm audit options

ALFA-group /BRON

"Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting" by Erik Hemberg, Jonathan Kelly, Michal Shlapentokh-Rothman, Bryn Reinstadler, Katherine Xu, Nick Rutar, Una-May O'Reilly

vfeedio /pyvfeed

Python API for vFeed Vulnerability & Threat Intelligence Database Enterprise & Pro Editions

s2e-lab /SecurityEval

Repository for "SecurityEval Dataset: Mining Vulnerability Examples to Evaluate Machine Learning-Based Code Generation Techniques" published in MSR4P&S'22.

sickcodes /security

Collection of CVEs from Sick Codes, or collaborations on https://sick.codes security research & advisories.

Netxeo /skill-file-security

One command. 29 battle-tested security checks built into every AI coding assistant you already use without leaving your IDE.

amberzovitis /GraphKer

Open Source Tool - Cybersecurity Graph Database in Neo4j

OWASP /cwe-tool

A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration.