{"kind": "product", "path": "vulns/debian-14/busybox", "name": "busybox", "product": "busybox", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-92205", "noindex": false, "published": "2026-10-21T17:17:22.583Z", "modified": "2026-10-21T17:17:22.583Z", "cvss": 6.1, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "severity": "medium", "epss": 0.00314, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-92205", "title": "BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability", "description": "BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-705/", "https://nvd.nist.gov/vuln/detail/CVE-2026-92205"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88842", "noindex": false, "published": "2026-10-14T10:02:05.270Z", "modified": "2026-10-15T19:33:22.460Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88842", "title": "Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption", "description": "A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.", "references": ["https://access.redhat.com/errata/RHSA-2026:81391", "https://access.redhat.com/security/cve/CVE-2026-88842", "https://bugzilla.redhat.com/show_bug.cgi?id=2531355"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88829", "noindex": false, "published": "2026-10-14T10:00:42.946Z", "modified": "2026-10-15T15:09:08.090Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "high", "epss": 0.00261, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88829", "title": "Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy", "description": "A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88829", "https://bugzilla.redhat.com/show_bug.cgi?id=2531343", "https://nvd.nist.gov/vuln/detail/CVE-2026-88829"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-90954", "noindex": false, "published": "2026-10-14T10:00:08.215Z", "modified": "2026-10-19T19:04:36.467Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00235, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-90954", "title": "Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush", "description": "A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitr", "references": ["https://access.redhat.com/security/cve/CVE-2026-90954", "https://bugzilla.redhat.com/show_bug.cgi?id=2533007", "https://nvd.nist.gov/vuln/detail/CVE-2026-90954"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88834", "noindex": false, "published": "2026-10-13T16:58:04.572Z", "modified": "2026-10-13T17:16:43.731Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88834", "title": "Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds", "description": "A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88834", "https://bugzilla.redhat.com/show_bug.cgi?id=2531348", "https://nvd.nist.gov/vuln/detail/CVE-2026-88834"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88838", "noindex": false, "published": "2026-10-13T16:56:15.518Z", "modified": "2026-10-14T16:16:14.045Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00113, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88838", "title": "Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions", "description": "A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88838", "https://bugzilla.redhat.com/show_bug.cgi?id=2531352", "https://nvd.nist.gov/vuln/detail/CVE-2026-88838"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88833", "noindex": false, "published": "2026-10-13T16:56:11.068Z", "modified": "2026-10-16T22:22:10.834Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88833", "title": "Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service", "description": "A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88833", "https://bugzilla.redhat.com/show_bug.cgi?id=2531347", "https://nvd.nist.gov/vuln/detail/CVE-2026-88833"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-108119", "noindex": false, "published": "2026-10-09T16:45:59.735Z", "modified": "2026-10-13T16:59:20.957Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00134, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-108119", "title": "Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix", "description": "A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.", "references": ["https://access.redhat.com/errata/RHSA-2026:81391", "https://access.redhat.com/security/cve/CVE-2026-108119", "https://bugzilla.redhat.com/show_bug.cgi?id=2548611"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88841", "noindex": false, "published": "2026-09-29T00:00:00Z", "modified": "2026-10-17T13:01:15.818436701Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88841", "title": "UBUNTU-CVE-2026-88841", "description": "[Unknown description]", "references": ["https://ubuntu.com/security/CVE-2026-88841", "https://www.cve.org/CVERecord?id=CVE-2026-88841", "https://bugzilla.redhat.com/show_bug.cgi?id=2539987"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88840", "noindex": false, "published": "2026-09-23T17:45:34.724Z", "modified": "2026-09-26T22:51:21.731Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00205, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88840", "title": "Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello", "description": "BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88840", "https://bugzilla.redhat.com/show_bug.cgi?id=2531354", "https://nvd.nist.gov/vuln/detail/CVE-2026-88840"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88839", "noindex": false, "published": "2026-09-23T17:45:33.584Z", "modified": "2026-09-25T22:28:25.024Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.00124, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88839", "title": "Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint", "description": "BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.", "references": ["https://access.redhat.com/errata/RHSA-2026:72111", "https://access.redhat.com/security/cve/CVE-2026-88839", "https://bugzilla.redhat.com/show_bug.cgi?id=2531353"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88837", "noindex": false, "published": "2026-09-23T17:45:31.496Z", "modified": "2026-09-25T22:28:21.760Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00273, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88837", "title": "Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication", "description": "BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.", "references": ["https://access.redhat.com/errata/RHSA-2026:72111", "https://access.redhat.com/security/cve/CVE-2026-88837", "https://bugzilla.redhat.com/show_bug.cgi?id=2531351"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88835", "noindex": false, "published": "2026-09-23T17:45:27.703Z", "modified": "2026-09-25T22:28:21.858Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.00117, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88835", "title": "Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages", "description": "BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.", "references": ["https://access.redhat.com/errata/RHSA-2026:72111", "https://access.redhat.com/security/cve/CVE-2026-88835", "https://bugzilla.redhat.com/show_bug.cgi?id=2531349"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88831", "noindex": false, "published": "2026-09-23T17:45:23.299Z", "modified": "2026-09-25T22:28:19.246Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00237, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88831", "title": "Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths", "description": "BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.", "references": ["https://access.redhat.com/errata/RHSA-2026:72111", "https://access.redhat.com/security/cve/CVE-2026-88831", "https://bugzilla.redhat.com/show_bug.cgi?id=2531346"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88832", "noindex": false, "published": "2026-09-23T17:05:00.787Z", "modified": "2026-09-25T22:12:51.387Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00131, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88832", "title": "Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow", "description": "BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.", "references": ["https://access.redhat.com/errata/RHSA-2026:72111", "https://access.redhat.com/security/cve/CVE-2026-88832", "https://bugzilla.redhat.com/show_bug.cgi?id=2531345"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-88830", "noindex": false, "published": "2026-09-23T17:04:57.011Z", "modified": "2026-09-24T16:26:07.002Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88830", "title": "Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow", "description": "A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88830", "https://bugzilla.redhat.com/show_bug.cgi?id=2531344", "https://nvd.nist.gov/vuln/detail/CVE-2026-88830"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-76014", "noindex": false, "published": "2026-08-19T02:45:08.531Z", "modified": "2026-08-25T01:49:44.780Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76014", "title": "BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference", "description": "A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.", "references": ["https://vuldb.com/vuln/391923", "https://vuldb.com/vuln/391923/cti", "https://vuldb.com/cve/CVE-2026-76014"], "fixes": [], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-38755", "noindex": false, "published": "2026-07-15T00:00:00.000Z", "modified": "2026-07-20T15:30:59.964Z", "cvss": 2.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00207, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-38755", "title": "CVE-2026-38755", "description": "A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.", "references": ["https://busybox.net", "https://lists.busybox.net/pipermail/busybox/2026-June/092354.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-38755"], "fixes": ["1:1.38.0-3"], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-38754", "noindex": false, "published": "2026-07-15T00:00:00.000Z", "modified": "2026-07-22T14:42:57.143Z", "cvss": 5.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00235, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-38754", "title": "CVE-2026-38754", "description": "A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.", "references": ["https://busybox.net", "https://lists.busybox.net/pipermail/busybox/2026-June/092353.html", "https://lists.busybox.net/pipermail/busybox/2026-June/092360.html"], "fixes": ["1:1.38.0-3"], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-38753", "noindex": false, "published": "2026-07-15T00:00:00.000Z", "modified": "2026-07-20T15:33:13.060Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-38753", "title": "CVE-2026-38753", "description": "A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.", "references": ["https://busybox.net", "https://lists.busybox.net/pipermail/busybox/2026-June/092352.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-38753"], "fixes": ["1:1.38.0-3"], "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}]}], "total": 66, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "busybox", "path": "vulns/debian-14/busybox", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 9, "kev": 0}, "lastmod": "2026-10-21T17:17:22.583Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}