{"kind": "product", "path": "vulns/npm/@nyariv%2Fsandboxjs", "name": "@nyariv/sandboxjs", "product": "@nyariv/sandboxjs", "ecosystem": "npm", "items": [{"id": "CVE-2026-43898", "noindex": false, "published": "2026-05-28T17:50:31.581Z", "modified": "2026-05-28T19:32:45.499Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00472, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-43898", "title": "SandboxJS: Sandbox escape via Function.caller leakage of internal call op", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw", "https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5", "https://nvd.nist.gov/vuln/detail/CVE-2026-43898"], "fixes": ["0.9.6"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-34217", "noindex": false, "published": "2026-04-06T15:12:52.871Z", "modified": "2026-04-06T15:40:46.653Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-34217", "title": "SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w", "https://nvd.nist.gov/vuln/detail/CVE-2026-34217"], "fixes": ["0.8.36"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-34211", "noindex": false, "published": "2026-04-06T15:10:42.261Z", "modified": "2026-04-07T14:09:53.356Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00395, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-34211", "title": "SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. This vulnerability is fixed in 0.8.36.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-8pfc-jjgw-6g26", "https://nvd.nist.gov/vuln/detail/CVE-2026-34211"], "fixes": ["0.8.36"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-34208", "noindex": false, "published": "2026-04-06T15:09:28.219Z", "modified": "2026-04-06T18:39:14.717Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "severity": "critical", "epss": 0.00561, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-34208", "title": "SandboxJS: Sandbox integrity escape", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-2gg9-6p7w-6cpj", "https://nvd.nist.gov/vuln/detail/CVE-2026-34208"], "fixes": ["0.8.36"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-32723", "noindex": false, "published": "2026-03-18T21:27:35.349Z", "modified": "2026-03-19T15:51:43.598Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-32723", "title": "SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7p5m-xrh7-769r", "https://github.com/nyariv/SandboxJS/commit/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29", "https://nvd.nist.gov/vuln/detail/CVE-2026-32723"], "fixes": ["0.8.35"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-26954", "noindex": false, "published": "2026-03-13T15:51:13.413Z", "modified": "2026-03-16T17:06:55.221Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00569, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-26954", "title": "SandboxJS has a Sandbox Escape", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-6r9f-759j-hjgv", "https://nvd.nist.gov/vuln/detail/CVE-2026-26954"], "fixes": ["0.8.34"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-25881", "noindex": false, "published": "2026-02-09T21:12:58.981Z", "modified": "2026-02-10T15:58:08.474Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00622, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25881", "title": "@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-ww7g-4gwx-m7wj", "https://github.com/nyariv/SandboxJS/commit/f369f8db26649f212a6a9a2e7a1624cb2f705b53", "https://nvd.nist.gov/vuln/detail/CVE-2026-25881"], "fixes": ["0.8.31"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-25586", "noindex": false, "published": "2026-02-06T19:54:38.446Z", "modified": "2026-02-06T20:17:19.095Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00702, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25586", "title": "SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-jjpw-65fv-8g48", "https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3", "https://nvd.nist.gov/vuln/detail/CVE-2026-25586"], "fixes": ["0.8.29"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-25520", "noindex": false, "published": "2026-02-06T19:53:24.219Z", "modified": "2026-02-06T20:18:08.646Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00863, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25520", "title": "SandboxJS has a Sandbox Escape", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-58jh-xv4v-pcx4", "https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3", "https://nvd.nist.gov/vuln/detail/CVE-2026-25520"], "fixes": ["0.8.29"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-25587", "noindex": false, "published": "2026-02-06T19:51:56.208Z", "modified": "2026-02-06T20:19:06.992Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00711, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25587", "title": "SandboxJS has a Sandbox Escape", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-66h4-qj4x-38xp", "https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3", "https://nvd.nist.gov/vuln/detail/CVE-2026-25587"], "fixes": ["0.8.29"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-25641", "noindex": false, "published": "2026-02-06T19:50:11.634Z", "modified": "2026-02-06T20:20:03.764Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00529, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25641", "title": "SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7x3h-rm86-3342", "https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3", "https://github.com/nyariv/SandboxJS/blob/6103d7147c4666fe48cfda58a4d5f37005b43754/src/executor.ts#L304-L304"], "fixes": ["0.8.29"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-25142", "noindex": false, "published": "2026-02-02T22:51:40.651Z", "modified": "2026-02-04T16:53:07.833Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.01213, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25142", "title": "SandboxJS Prototype Pollution -> Sandbox Escape -> RCE", "description": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-9p4w-fq8m-2hp7", "https://github.com/nyariv/SandboxJS/commit/75c8009db32e6829b0ad92ca13bf458178442bd3", "https://github.com/nyariv/SandboxJS/blob/f212a38fb5a6d4bc2bc2e2466c0c011ce8d41072/src/executor.ts#L368-L398"], "fixes": ["0.8.27"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2026-23830", "noindex": false, "published": "2026-01-27T23:32:16.104Z", "modified": "2026-01-28T15:09:44.543Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.01219, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-23830", "title": "SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor", "description": "SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups. However, before version 0.8.26, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` ", "references": ["https://github.com/nyariv/SandboxJS/security/advisories/GHSA-wxhw-j4hc-fmq6", "https://github.com/nyariv/SandboxJS/commit/345aee6566e47979dee5c337b925b141e7f78ccd", "https://nvd.nist.gov/vuln/detail/CVE-2026-23830"], "fixes": ["0.8.26"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}, {"id": "CVE-2025-34146", "noindex": false, "published": "2025-07-31T14:59:35.716Z", "modified": "2026-10-08T15:21:18.196Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00245, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-34146", "title": "nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS", "description": "A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.", "references": ["https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b8518d7e3", "https://github.com/nyariv/SandboxJS/issues/31", "https://www.npmjs.com/package/@nyariv/sandboxjs"], "fixes": ["0.8.24"], "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@nyariv/sandboxjs", "path": "vulns/npm/@nyariv%2Fsandboxjs", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:21:18.196Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}