I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links which lists open-source/commercial source code analysis tools: https://www.owasp.org/index.php/Source_Code_Analysis_Tools https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#Java https://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html
Afterwards I made a list of open-source tools which can scan for security vulnerabilities in Java code i.e. FindBugs, LAPSE+, SWAAT and Orizon by OWASP, VCG, Google CodeSearchDiggity, and YASCA as an aggregator of these tools. FindBugs and LAPSE+ are available as Eclipse plugins. VCG was more of bare backbone where you can add your custom rules and less to offer as it is and runs only on Windows platform. LAPSE+ require specific Eclipse version to run (Helios in my case).
I want to find at least OWASP Top 10 vulnerabilities by performing static source code analysis. Any way to do that?