Are there code scanners in the market that scan HTML 5 code?
Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
There are no 'scanners' yet, but you might be able to enrich existing code scanners with new rules for the HTML5. OWASP HTML5 Security Cheatsheet is a good resource you might use to compile such rules, for example it lists insecure CORS headers configuration, but it also touches other HTML5 subjects like insecure WebSockets configuration. You can also add e.g. new XSS vectors using HTML5 features from http://html5sec.org/ - there's a text-only version of these payloads on GitHub.