cve-maker is a hub for finding CVEs and exploits. It is based on the official NIST, ExploitDB and Github databases. The tool makes it quick and easy to search for CVEs and their associated exploits. It is able to detect exploit compilation options. It can also be used to list the latest critical vulnerabilities.
EZGHSA is a command-line tool for summarizing and filtering vulnerability alerts on Github repositories. List alerts for a user, organization, or specific set of repositories. Display Github Security Advisory (GHSA) IDs. Filter alerts by ID, severity, and age. Check if alerts are enabled or disabled. Run interactively or from CI/CD scripts.
EZGHSA needs to authenticate with the Github API.
Documentation for Ubuntu's vulnerability API.
Over 100 forks of deliberately vulnerable web applications and APIs to practice on.
Canonical’s Security Team produces Ubuntu OVAL, a structured, machine-readable dataset for all supported Ubuntu releases. It can be used to evaluate and manage security risks related to any existing Ubuntu components. It is based on the Open Vulnerability and Assessment Language (OVAL).
Ubuntu OVAL also allows for any third-party Security Content Automation Protocol (SCAP) compliant tools to accurately scan an Ubuntu system or an official Ubuntu OCI image for vulnerabilities.
wget https://security-metadata.canonical.com/oval/com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2
Imports vulnerability data from your continual monitoring and scanning infrastructure and does all the legwork of documenting, finding references, mapping to CVEs, and so forth.
Faraday aggregates and normalizes the data you load, allowing exploring it into different visualizations that are useful to managers and analysts alike.
Uses Postgres as its back-end.
An open, precise, and distributed approach to producing and consuming vulnerability information for open source.
All advisories in this database use the OpenSSF OSV format, which was developed in collaboration with open source communities. The OSV schema provides a human and machine readable data format to describe vulnerabilities in a way that precisely maps to open source package versions or commit hashes.
An easy-to-use API is available to query for all known vulnerabilities by either a commit hash, or a package version.
Patch into Searx?
A somewhat silly website that talks about recently discovered 0-day vulnerabilities.
RSS feed: https://0dayfans.com/feed.rss
An open project to list all known cloud vulnerabilitiesand Cloud Service Provider security issues.
OpenCVE lets you search the CVE you want filtered by vendor, product, CVSS or CWE. Synchronized with the feed provided by the NVD. So each CVE displays the standards you already know (CVE, CPE, CWE, CVSS). You can then subscribe as many vendors or products as you want, and you will be notified as soon as a CVE concerning them is published or updated. Your custom dashboards and reports only include the CVEs associated with your subscriptions, and you can filter the list by keywords of CVSS score. OpenCVE keeps track of the changes, so you can find the history of your alerts in your Reports page. Can be self-hosted if you're concerned about leaking information outside of your organization.
REST API: https://docs.opencve.io/api/
Community driven open database of vulnerability exploitation in the wild. We believe that exploitation information is about safety and it should be easy to access and not be behind paywalls. Get alerts on new reports of exploitation via RSS, Twitter, grab our docker image, the hourly database exports or get the full exploited list in the API.
The mission of the CVE Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There is one CVE Record for each vulnerability in the catalog. The vulnerabilities are discovered then assigned and published by organizations from around the world that have partnered with the CVE Program. Partners publish CVE Records to communicate consistent descriptions of vulnerabilities. Information technology and cybersecurity professionals use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritize and address the vulnerabilities.
vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable PHP Interface that demonstrates OWASP API Top 10 in the means of Exercises. Requires PHP, Apache, MySQL, and probably a man-in-the-middle proxy.
Static security analyzer for Golang code. Checks against the Golang AST. Tries to verify some best practices (no hardcoded credentials, listening on 0.0.0.0 by default, things like that. Has all of the usual CLI options you'd hope it has.
Offensive Security Training has taken over where Milw0rm left off in their archival of live exploits, vulnerability descriptions, attacks, and whitepapers.
National Vulnerability Database.
Clair is a FOSS utility for conducting static security analysis of Linux containers, Docker containers in particular. Clair continually updates its internal index of known vulnerabilities so it can keep constant watch over what it monitors. Has a modular architecture to make it easier to extend the project without having to fork() it. Also designed to fit into a CI/CD pipeline to monitor in-house containers as they're built. Plugs into Kubernetes. Requires Postgres. Written in Go. sysadmin infosec scanner scanning