Is there a tool to track CVEs for the software that we use?

• DependencyCheck

  4 4,056 9.8 Java

  OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

• Spotbugs

  10 2,720 9.1 Java

  SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

  

  While at it you could also point them to static code analyzers such as error_prone, spotbugs and pmd (use all 3 at once - they complement each other in detecting different issues).

• Scout APM

  scoutapm.com

  sponsored

  Less time debugging, more time building. Scout APM allows you to find and fix performance issues with no hassle. Now with error monitoring and external services monitoring, Scout is a developer's best friend when it comes to application development.

  

• PMD

  10 3,848 9.8 Java

  An extensible multilanguage static code analyzer.

  

  While at it you could also point them to static code analyzers such as error_prone, spotbugs and pmd (use all 3 at once - they complement each other in detecting different issues).

• Error Prone

  6 5,956 9.8 Java

  Catch common Java mistakes as compile-time errors

  

  While at it you could also point them to static code analyzers such as error_prone, spotbugs and pmd (use all 3 at once - they complement each other in detecting different issues).

• vulnmine

  1 32 10.0 Python

  Vulnmine searches for vulnerable hosts using MS SCCM host / software inventory data with NIST NVD Vulnerability feed data.

  

  It is hard. Look at vulmine and the logic behind it for feeding SCCM reports into it.

• opencve

  10 1,059 7.1 Python

  CVE Alerting Platform

  

  there's also https://www.opencve.io/ which can be selfhosted if wanted

• openvas-scanner

  3 1,642 9.1 C

  This repository contains the scanner component for Greenbone Vulnerability Management (GVM). If you are looking for the whole OpenVAS framework please take a look at https://community.greenbone.net/t/frequently-asked-questions-faq/5558.

  

  I don't recommend cheaping out on vuln scanning, but if you really can't get any money there's always OpenVAS. That will allow you to do credentialed scanning and track vulnerabilities in your environment. It's no real substitute for Tenable or similar, but it's better than nothing.

• SonarLint

  www.sonarlint.org

  sponsored

  Deliver Cleaner and Safer Code - Right in Your IDE of Choice!. SonarLint is a free and open source IDE extension that identifies and catches bugs and vulnerabilities as you code, directly in the IDE. Install from your favorite IDE marketplace today.

  

• Wazuh

  46 3,666 9.9 C

  Wazuh - The Open Source Security Platform

  

  Hi, Wazuh employee here! I think that you might be interested in implementing Wazuh in your company, it's an open-source SIEM that allows you to monitor not only the CVEs that could affect the software that your company uses, but also misconfigurations that could lead to attacks from malicious actors, intrusion detection -such as detecting brute-forcing attacks-, and many other interesting capabilities.

Suggest a related project