OWASP ZAP (Zed Attack Proxy)
Apache 2.0The world's most widely used free web app security scanner, providing intercepting proxies, active automated vulnerability fuzzers, and headless API automation tailored for CI/CD pipelines.
🛡️ DevSecOps & Security Scanners
Open-Source Security & Vulnerability Scanners
Essential open-source tools for automated dynamic web application testing (DAST), container image vulnerability scanning, and infrastructure auditing.
Aqua Trivy
Apache 2.0A comprehensive, blazing-fast security scanner for container images, Git repositories, Kubernetes manifests, and IaC configurations to detect known CVEs, secrets, and software misconfigurations.
Anchore Grype
Apache 2.0An easy-to-integrate vulnerability scanner for container images and filesystems that pairs seamlessly with Syft Software Bill of Materials (SBOM) generators to detect unpatched packages.
Nikto
GPLv2A classic, thorough open-source command-line web server scanner that tests remote hosts for over 6,700 potentially dangerous files, outdated server programs, and insecure HTTP header configs.
OpenVAS (Greenbone Community Edition)
GPLv2A full-featured network vulnerability scanner containing a daily-updated feed of tens of thousands of Network Vulnerability Tests (NVTs) to uncover unpatched services across entire server subnets.