DevFixProDev Toolkit
Home / Lists / DevFix Hub / 15 Open-Source Vulnerability Scanners & Pentest Tools (GitHub Stars 2026)

15 Open-Source Vulnerability Scanners & Pentest Tools (GitHub Stars 2026)

The most-starred open-source vulnerability scanners and pentest tools on GitHub - SAST, container scanning, secret detection and exploitation frameworks.

By The DevFixPro Editorial Team · independent editorial research project

Star counts retrieved from the GitHub API on 2026-08-17. Open-source projects grow daily, so treat the numbers as a snapshot — always check the linked repository for the latest figures, license, and activity.

Finding vulnerabilities before attackers do starts with the right scanner. This list ranks 15 of the most popular open-source vulnerability scanners and pentest tools by GitHub stars (fetched 2026-08-17) - from SAST and container scanning to secret detection and full exploitation frameworks.

Pair a SAST tool (Semgrep, Bandit) with a container scanner (Trivy, Grype) and a web scanner (ZAP, Nuclei) for coverage across code, image and runtime.

  1. 1OWASP ZAP on GitHub
    OWASP ZAP★ 15,621
    By ZAP Dev Team

    Free, open-source web-app scanner for finding vulnerabilities in your applications.

    View on GitHub →
  2. 2Nuclei on GitHub
    Nuclei★ 30,556
    By ProjectDiscovery

    Template-based fast vulnerability scanner for external attack surface.

    View on GitHub →
  3. 3Trivy on GitHub
    Trivy★ 37,444
    By Aqua Security

    Find vulnerabilities, misconfigurations and secrets in containers, IaC and SBOM.

    View on GitHub →
  4. 4sqlmap on GitHub
    sqlmap★ 38,201
    By sqlmapproject

    Automates detecting and exploiting SQL injection flaws in a database.

    View on GitHub →
  5. 5Metasploit Framework on GitHub
    Metasploit Framework★ 38,818
    By Rapid7

    The most-used penetration-testing framework for exploit dev and validation.

    View on GitHub →
  6. 6Semgrep on GitHub
    Semgrep★ 16,251
    By Semgrep

    Fast static analysis to find bugs and risky patterns across many languages.

    View on GitHub →
  7. 7Grype on GitHub
    Grype★ 12,751
    By Anchore

    Scan container images and filesystems for known vulnerabilities.

    View on GitHub →
  8. 8Bandit on GitHub
    Bandit★ 8,222
    By PyCQA

    Static analyzer that finds common security issues in Python code.

    View on GitHub →
  9. 9Gitleaks on GitHub
    Gitleaks★ 28,772
    By Gitleaks

    Detect and prevent hardcoded secrets and credentials in git repos.

    View on GitHub →
  10. 10TruffleHog on GitHub
    TruffleHog★ 27,493
    By Truffle Security

    Find credentials across git history, files and live sources.

    View on GitHub →
  11. 11Lynis on GitHub
    Lynis★ 16,164
    By CISOfy

    Security auditing and hardening tool for Linux/Unix systems.

    View on GitHub →
  12. 12Clair on GitHub
    Clair★ 11,048
    By Quay

    Static analysis of vulnerabilities in container images.

    View on GitHub →
  13. 13Dependency-Check on GitHub
    Dependency-Check★ 54
    By Jeremy Long

    Detects known vulnerable dependencies in project libraries.

    View on GitHub →
  14. 14Wapiti on GitHub
    Wapiti★ 1,841
    By Wapiti Scanner

    Black-box web-app vulnerability scanner (injections, XSS, file handling).

    View on GitHub →
  15. 15Nikto on GitHub
    Nikto★ 10,659
    By Sullo

    Web server scanner that tests for dangerous files, outdated services and config issues.

    View on GitHub →

← Back to DevFix Hub