Open source repositories tagged with #vulnerable, ranked by health score.
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application