CodeQL will do this for some languages, the kind of bugs I've seen it identify have been pretty impressive, I'm sure there are some other static analyzers that can do this as well.
I was rather thinking of a specialized scanner (say only for C sources) that just looks for definite classes of vulns, not necessarily scriptable.