A curated list of vulnerability scanners — both free and commercial — organized by type.
Name
License
Self-hosted
Links
Description
Nmap Free / Open Source
yes
GitHub De facto standard for network discovery and port scanning. NSE scripts add vulnerability detection.
Masscan Free / Open Source
yes
GitHub Internet-scale port scanner. Sends millions of packets per second — faster than Nmap for large ranges.
OpenVAS / Greenbone Free / Open Source
yes
GitHub Full-featured network vulnerability scanner. The open source core behind Greenbone Security Manager.
Nessus Essentials Free (limited, 16 IPs)
yes
—
Free version of Nessus. Industry gold standard for vulnerability scanning.
Nexpose / InsightVM Commercial
yes + SaaS
—
Rapid7 network and endpoint scanner with real-time risk scoring and remediation workflows.
Zmap Free / Open Source
yes
GitHub Single-packet scanner designed for internet-wide surveys. Complements Nmap for large-scale research.
Name
License
Self-hosted
Links
Description
OWASP ZAP Free / Open Source
yes
GitHub Most widely used open source web app scanner. Supports active/passive scanning and CI/CD integration.
Burp Suite Free (Community) + Commercial
yes
—
Industry-standard web security testing platform. Community is free; Pro adds automated scanning.
Nikto Free / Open Source
yes
GitHub Web server scanner that checks for outdated software, misconfigurations and known vulnerabilities.
Wapiti Free / Open Source
yes
GitHub Black-box web vulnerability scanner. Tests for SQLi, XSS, file inclusion, SSRF and more.
SQLMap Free / Open Source
yes
GitHub Automated SQL injection detection and exploitation tool. Supports all major database backends.
w3af Free / Open Source
yes
GitHub Web application attack and audit framework with over 200 plugins covering OWASP Top 10.
Nuclei Free / Open Source
yes
GitHub Fast template-based scanner with a massive community library covering CVEs and misconfigurations.
Acunetix Commercial
SaaS + On-prem
—
Commercial web app scanner with deep crawling, JavaScript rendering and IAST support.
Container and Cloud Scanners
Name
License
Self-hosted
Links
Description
Trivy Free / Open Source
yes
GitHub All-in-one scanner for container images, filesystems, Git repos and IaC. Excellent CI/CD integration.
Grype Free / Open Source
yes
GitHub Container and filesystem vulnerability scanner from Anchore. Pairs with Syft for SBOM generation.
Clair Free / Open Source
yes
GitHub Static analysis of container images for known vulnerabilities. Used by Quay.io and Harbor.
Falco Free / Open Source
yes
GitHub Runtime security for containers and Kubernetes. Detects anomalous behavior via kernel syscall monitoring.
Prowler Free / Open Source
yes
GitHub AWS, GCP and Azure security assessment. Checks against CIS benchmarks, GDPR, HIPAA and more.
ScoutSuite Free / Open Source
yes
GitHub Multi-cloud security auditing by NCC Group. Supports AWS, Azure, GCP, Alibaba Cloud and more.
Checkov Free / Open Source
yes
GitHub Static analysis for IaC (Terraform, CloudFormation, Kubernetes, Helm, ARM templates).
Anchore Enterprise Commercial
yes
—
Enterprise version of Grype/Syft with policy engine, reporting and registry integration.
Name
Language(s)
License
Links
Description
Semgrep 30+ languages
Free + Commercial
GitHub Fast, lightweight static analysis engine. Community rules cover OWASP Top 10 across 30+ languages.
CodeQL C, C#, Go, Java, JS, Python, Ruby, Swift
Free (open source)
GitHub GitHub semantic code analysis engine. Powers automated security reviews in GitHub Advanced Security.
SonarQube 20+ languages
Free (Community) + Commercial
GitHub Continuous code quality and security analysis. Integrates into most CI pipelines.
Bandit Python
Free / Open Source
GitHub Python-specific SAST tool that finds common security issues in Python code.
Brakeman Ruby on Rails
Free / Open Source
GitHub Static analysis security scanner specifically for Ruby on Rails applications.
Gosec Go
Free / Open Source
GitHub Golang security checker that inspects source code for security problems.
ESLint Security JavaScript / Node.js
Free / Open Source
GitHub ESLint plugin that detects potential security vulnerabilities in Node.js code.
Checkmarx Multi-language
Commercial
—
Enterprise SAST/DAST/SCA platform with deep dataflow analysis.
Infrastructure and Compliance
Name
License
Self-hosted
Links
Description
Lynis Free / Open Source
yes
GitHub Security auditing tool for Linux, macOS and Unix. Performs hardening checks and compliance assessments.
OpenSCAP Free / Open Source
yes
GitHub NIST SCAP standard implementation for configuration compliance scanning. Used by many Linux vendors.
Vuls Free / Open Source
yes
GitHub Agentless Linux/FreeBSD vulnerability scanner. Scans installed packages against NVD and vendor advisories.
Chef InSpec Free / Open Source
yes
GitHub Compliance-as-code framework for testing infrastructure against security policies and regulations.
Name
Type
Description
Qualys VMDR SaaS
Cloud-based vulnerability management, detection and response. One of the largest vulnerability KBs in the industry.
Tenable.io SaaS
Cloud version of Nessus with asset discovery, risk-based prioritization and reporting.
Tenable Nessus Pro On-prem
Full commercial Nessus with unlimited IPs and advanced scanning policies.
Rapid7 InsightVM SaaS + On-prem
Live vulnerability and risk management with Metasploit integration.
Holm Security SaaS
Scandinavian vulnerability management platform with asset discovery and threat intelligence.
Snyk SaaS + CLI
Developer-first security platform covering open source, code, containers and IaC.
Veracode SaaS
Application security testing platform covering SAST, DAST, SCA and penetration testing.
See CONTRIBUTING.md for guidelines on how to add a new scanner.
A machine-readable version of this list is available in scanners.json .
