I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly where in the code the vulnerabilities have occurred in the past, and how it was patched (if it is patched).

  • 4
    you could search Github for CVEs in the "issues" section of repos ....
    – schroeder
    May 15, 2016 at 20:36
  • You can search the CVE database for apps that you know to b3 open source and then look at their source code to find the fixes May 16, 2016 at 0:53

4 Answers 4


Check out exploitdb by Offensive Security: https://www.exploit-db.com/


Try this one (https://blogs.securiteam.com/index.php/archives/2543#more-2543), the advisory shows the vulnerable code and since it's an open source product the patch is available from the vendor source code (http://www.live555.com/liveMedia/public/).


Rapid7 is also a great place. You can try to run a granular google search there.

site:https://www.rapid7.com/ "CVE"

Most of the time you'll see great examples of vulnerabilities and threats along with where to find hotfixes for them.


As mentioned, exploit-db will have a solid repository of memory corruption bugs sorted by category. But you also asked for fixes; these are usually found on the vendors website under the name 'diffs' (differences)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .