{"kind": "product", "path": "vulns/debian-13/memcached", "name": "memcached", "product": "memcached", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-90698", "noindex": false, "published": "2026-09-14T08:30:12.665Z", "modified": "2026-09-15T15:55:39.158Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00859, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2026-90698", "title": "memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds", "description": "A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.", "references": ["https://vuldb.com/vuln/403231", "https://vuldb.com/vuln/403231/cti", "https://vuldb.com/cve/CVE-2026-90698"], "fixes": [], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-47784", "noindex": false, "published": "2026-05-20T05:45:37.864Z", "modified": "2026-05-20T12:21:02.894Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0055, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2026-47784", "title": "CVE-2026-47784", "description": "In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.", "references": ["https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed", "https://github.com/memcached/memcached/compare/1.6.41...1.6.42", "https://github.com/memcached/memcached/wiki/ReleaseNotes1642"], "fixes": [], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-47783", "noindex": false, "published": "2026-05-20T05:43:46.976Z", "modified": "2026-09-18T12:04:50.505Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01264, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2026-47783", "title": "CVE-2026-47783", "description": "In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.", "references": ["https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed", "https://github.com/memcached/memcached/compare/1.6.41...1.6.42", "https://github.com/memcached/memcached/wiki/ReleaseNotes1642"], "fixes": [], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2023-46853", "noindex": false, "published": "2023-10-27T00:00:00.000Z", "modified": "2024-09-09T15:31:32.160Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.00756, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2023-46853", "title": "CVE-2023-46853", "description": "In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \\n is used instead of \\r\\n.", "references": ["https://github.com/memcached/memcached/compare/1.6.21...1.6.22", "https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa", "https://nvd.nist.gov/vuln/detail/CVE-2023-46853"], "fixes": ["1.6.22-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2023-46852", "noindex": false, "published": "2023-10-27T00:00:00.000Z", "modified": "2024-09-09T15:36:33.049Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.00778, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2023-46852", "title": "CVE-2023-46852", "description": "In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the \"get\" substring.", "references": ["https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767", "https://github.com/memcached/memcached/compare/1.6.21...1.6.22", "https://nvd.nist.gov/vuln/detail/CVE-2023-46852"], "fixes": ["1.6.22-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-48571", "noindex": false, "published": "2023-08-22T00:00:00.000Z", "modified": "2024-10-03T14:07:05.902Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.01094, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2022-48571", "title": "CVE-2022-48571", "description": "memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.", "references": ["https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966", "https://lists.debian.org/debian-lts-announce/2023/09/msg00004.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-48571"], "fixes": ["1.6.8+dfsg-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-22570", "noindex": false, "published": "2023-08-22T00:00:00.000Z", "modified": "2024-10-03T18:05:32.754Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.01337, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2020-22570", "title": "CVE-2020-22570", "description": "Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.", "references": ["https://github.com/memcached/memcached/issues/636", "https://nvd.nist.gov/vuln/detail/CVE-2020-22570"], "fixes": ["1.6.3-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-37519", "noindex": false, "published": "2023-02-03T00:00:00.000Z", "modified": "2025-03-26T18:16:52.051Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00363, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2021-37519", "title": "CVE-2021-37519", "description": "Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.", "references": ["https://github.com/memcached/memcached/issues/805", "https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0", "https://nvd.nist.gov/vuln/detail/CVE-2021-37519"], "fixes": ["1.6.10+dfsg-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-10931", "noindex": false, "published": "2020-03-24T14:25:56.000Z", "modified": "2024-08-04T11:21:12.992Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.28144, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2020-10931", "title": "CVE-2020-10931", "description": "Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.", "references": ["https://github.com/memcached/memcached/issues/629", "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305", "https://github.com/memcached/memcached/wiki/ReleaseNotes162"], "fixes": ["1.6.2-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2019-15026", "noindex": false, "published": "2019-08-30T14:32:01.000Z", "modified": "2024-08-05T00:34:53.130Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02638, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2019-15026", "title": "CVE-2019-15026", "description": "memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.", "references": ["https://github.com/memcached/memcached/wiki/ReleaseNotes1517", "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819", "https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html"], "fixes": ["1.5.17-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2019-11596", "noindex": false, "published": "2019-04-29T14:46:55.000Z", "modified": "2024-08-04T22:55:41.048Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02958, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2019-11596", "title": "CVE-2019-11596", "description": "In memcached before 1.5.14, a NULL pointer dereference was found in the \"lru mode\" and \"lru temp_ttl\" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.", "references": ["https://github.com/memcached/memcached/issues/474", "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02", "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f"], "fixes": ["1.5.6-1.1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2018-1000127", "noindex": false, "published": "2018-03-13T21:00:00.000Z", "modified": "2024-08-05T12:33:49.281Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02265, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2018-1000127", "title": "CVE-2018-1000127", "description": "memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.", "references": ["https://access.redhat.com/errata/RHSA-2018:2290", "https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html", "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00"], "fixes": ["1.5.0-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2018-1000115", "noindex": false, "published": "2018-03-05T14:00:00.000Z", "modified": "2024-08-05T12:33:49.333Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.88114, "kev": false, "exploits": ["exploitdb", "metasploit"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2018-1000115", "title": "CVE-2018-1000115", "description": "Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.", "references": ["https://access.redhat.com/errata/RHBA-2018:2140", "https://access.redhat.com/errata/RHSA-2018:1593", "https://usn.ubuntu.com/3588-1/"], "fixes": ["1.5.6-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2017-9951", "noindex": false, "published": "2017-07-17T06:00:00.000Z", "modified": "2024-08-05T17:24:59.972Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.04166, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2017-9951", "title": "CVE-2017-9951", "description": "The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.", "references": ["https://usn.ubuntu.com/3588-1/", "https://github.com/memcached/memcached/wiki/ReleaseNotes1439", "http://www.securityfocus.com/bid/99874"], "fixes": ["1.5.0-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2016-8706", "noindex": false, "published": "2017-01-06T21:00:00.000Z", "modified": "2024-08-06T02:27:41.304Z", "cvss": 8.1, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.45703, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2016-8706", "title": "CVE-2016-8706", "description": "An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.", "references": ["https://security.gentoo.org/glsa/201701-12", "http://www.debian.org/security/2016/dsa-3704", "http://rhn.redhat.com/errata/RHSA-2016-2819.html"], "fixes": ["1.4.33-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2016-8705", "noindex": false, "published": "2017-01-06T21:00:00.000Z", "modified": "2024-08-06T02:27:41.285Z", "cvss": 9.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.19854, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2016-8705", "title": "CVE-2016-8705", "description": "Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.", "references": ["https://security.gentoo.org/glsa/201701-12", "http://www.debian.org/security/2016/dsa-3704", "http://rhn.redhat.com/errata/RHSA-2016-2819.html"], "fixes": ["1.4.33-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2016-8704", "noindex": false, "published": "2017-01-06T21:00:00.000Z", "modified": "2024-08-06T02:27:41.247Z", "cvss": 9.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.23173, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2016-8704", "title": "CVE-2016-8704", "description": "An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.", "references": ["https://security.gentoo.org/glsa/201701-12", "http://www.debian.org/security/2016/dsa-3704", "http://rhn.redhat.com/errata/RHSA-2016-2819.html"], "fixes": ["1.4.33-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2013-7291", "noindex": false, "published": "2014-01-13T21:00:00.000Z", "modified": "2024-08-06T18:01:20.388Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00931, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2013-7291", "title": "CVE-2013-7291", "description": "memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an \"unbounded key print\" during logging, related to an issue that was \"quickly grepped out of the source tree,\" a different vulnerability than CVE-2013-0179 and CVE-2013-7290.", "references": ["https://code.google.com/p/memcached/wiki/ReleaseNotes1417", "http://www.securityfocus.com/bid/64989", "https://code.google.com/p/memcached/issues/detail?id=306"], "fixes": ["1.4.20-1"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2013-7290", "noindex": false, "published": "2014-01-13T21:00:00.000Z", "modified": "2024-08-06T18:01:20.308Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00931, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2013-7290", "title": "CVE-2013-7290", "description": "The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.", "references": ["https://code.google.com/p/memcached/wiki/ReleaseNotes1417", "http://www.securityfocus.com/bid/64988", "https://code.google.com/p/memcached/issues/detail?id=306"], "fixes": ["1.4.13-0.2"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}, {"id": "CVE-2013-7239", "noindex": false, "published": "2014-01-13T21:00:00.000Z", "modified": "2024-08-06T18:01:20.106Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}], "path": "vulns/cve-2013-7239", "title": "CVE-2013-7239", "description": "memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.", "references": ["http://www.securityfocus.com/bid/64559", "https://code.google.com/p/memcached/wiki/ReleaseNotes1417", "http://seclists.org/oss-sec/2013/q4/572"], "fixes": ["1.4.13-0.3"], "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}]}], "total": 26, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "memcached", "path": "vulns/debian-13/memcached", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-18T12:04:50.505Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}