{"kind": "product", "path": "vulns/debian-14/onnx", "name": "onnx", "product": "onnx", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-115922", "noindex": false, "published": "2026-10-26T17:31:03.716Z", "modified": "2026-10-30T17:40:32.752Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00131, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115922", "title": "ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7", "https://github.com/onnx/onnx/pull/8033", "https://github.com/onnx/onnx/pull/8038"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-115921", "noindex": false, "published": "2026-10-26T17:28:41.420Z", "modified": "2026-10-26T17:28:41.420Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00131, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115921", "title": "ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-m4pr-6v3c-6fgr", "https://github.com/onnx/onnx/pull/7916", "https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-115920", "noindex": false, "published": "2026-10-26T17:26:40.506Z", "modified": "2026-10-26T19:48:35.202Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00178, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115920", "title": "ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-6pwm-x34p-fvj2", "https://github.com/onnx/onnx/pull/7997", "https://github.com/onnx/onnx/commit/2ec288908952eea9dcf48d4b197915e1f72c6abf"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-115919", "noindex": false, "published": "2026-10-26T17:24:40.346Z", "modified": "2026-10-26T19:34:47.244Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00178, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115919", "title": "ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-48m4-24cq-37qf", "https://github.com/onnx/onnx/pull/7879", "https://github.com/onnx/onnx/commit/92e541266af5dd38cfa48aeb92206f4268a066cd"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-49114", "noindex": false, "published": "2026-08-21T16:10:56.241Z", "modified": "2026-08-21T16:43:10.933Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-49114", "title": "ONNX symlink-following and path-traversal arbitrary file write", "description": "In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6", "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-233-01.json", "https://www.cve.org/CVERecord?id=CVE-2026-49114"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-63632", "noindex": false, "published": "2026-08-18T14:55:15.923Z", "modified": "2026-08-18T18:51:29.068Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-63632", "title": "ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in version 1.22.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-p893-rvq9-2xf9", "https://github.com/onnx/onnx/pull/7880", "https://github.com/onnx/onnx/commit/e9c74f596eaa0250f89e52a54160a25bbcb25b66"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-44512", "noindex": false, "published": "2026-07-08T19:32:04.886Z", "modified": "2026-07-09T13:36:58.289Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44512", "title": "ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77", "https://github.com/onnx/onnx/pull/7813", "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-14647", "noindex": false, "published": "2026-07-04T19:00:11.367Z", "modified": "2026-07-06T18:44:46.173Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14647", "title": "onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds", "description": "A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.", "references": ["https://vuldb.com/vuln/376160", "https://vuldb.com/vuln/376160/cti", "https://vuldb.com/cve/CVE-2026-14647"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-34447", "noindex": false, "published": "2026-04-01T17:39:38.129Z", "modified": "2026-04-01T19:14:38.114Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00258, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34447", "title": "ONNX: External Data Symlink Traversal", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-p433-9wv8-28xj", "https://nvd.nist.gov/vuln/detail/CVE-2026-34447"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-34446", "noindex": false, "published": "2026-04-01T17:37:54.737Z", "modified": "2026-04-02T14:10:36.637Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00183, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34446", "title": "ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-cmw6-hcpp-c6jp", "https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb", "https://nvd.nist.gov/vuln/detail/CVE-2026-34446"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-27489", "noindex": false, "published": "2026-04-01T17:33:51.281Z", "modified": "2026-07-15T01:14:13.726Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00616, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-27489", "title": "ONNX: Path Traversal via Symlink", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-3r9x-f23j-gc73", "https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb", "https://access.redhat.com/security/cve/CVE-2026-27489"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-34445", "noindex": false, "published": "2026-04-01T17:30:19.994Z", "modified": "2026-04-01T18:00:14.120Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "severity": "high", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34445", "title": "ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the \"keys\" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9", "https://github.com/onnx/onnx/pull/7751", "https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-28500", "noindex": false, "published": "2026-03-18T01:15:07.644Z", "modified": "2026-07-15T01:11:41.016Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00323, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28500", "title": "ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack", "description": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently e", "references": ["https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m", "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "https://access.redhat.com/security/cve/CVE-2026-28500"], "fixes": [], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-7776", "noindex": false, "published": "2025-03-20T10:10:58.740Z", "modified": "2025-03-20T15:52:00.491Z", "cvss": 8.1, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.01532, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-7776", "title": "Arbitrary File Overwrite in onnx/onnx", "description": "A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.", "references": ["https://huntr.com/bounties/a7a46cf6-1fa0-454b-988c-62d222e83f63", "https://nvd.nist.gov/vuln/detail/CVE-2024-7776"], "fixes": ["1.16.2-1"], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-5187", "noindex": false, "published": "2024-06-06T18:45:19.456Z", "modified": "2024-08-01T21:03:10.963Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-5187", "title": "Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx", "description": "A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/k", "references": ["https://huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237e", "https://nvd.nist.gov/vuln/detail/CVE-2024-5187"], "fixes": ["1.16.2-1"], "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}]}], "total": 15, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "onnx", "path": "vulns/debian-14/onnx", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-30T17:40:32.752Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}