{"kind": "product", "path": "vulns/npm/multer", "name": "multer", "product": "multer", "ecosystem": "npm", "items": [{"id": "CVE-2026-113872", "noindex": false, "published": "2026-10-22T14:20:18.363Z", "modified": "2026-10-22T19:00:31.884Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00441, "kev": false, "exploits": ["github-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-113872", "title": "multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown", "description": "multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storag", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-113872"], "fixes": ["2.5.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-88932", "noindex": false, "published": "2026-09-14T08:46:12.896Z", "modified": "2026-09-14T10:29:12.674Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00532, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-88932", "title": "multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads", "description": "multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88932"], "fixes": ["2.4.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82333", "noindex": false, "published": "2026-08-28T20:12:21.355Z", "modified": "2026-08-31T18:39:14.067Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00488, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82333", "title": "multer vulnerable to Denial of Service via oversized array index in field names", "description": "multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that ", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-82333"], "fixes": ["2.3.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-77078", "noindex": false, "published": "2026-08-28T20:03:23.114Z", "modified": "2026-08-31T18:40:24.545Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00488, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-77078", "title": "multer vulnerable to Denial of Service via crafted multipart field names", "description": "multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77078"], "fixes": ["2.3.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-77063", "noindex": false, "published": "2026-08-28T19:54:58.473Z", "modified": "2026-08-31T18:40:55.632Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-77063", "title": "multer vulnerable to file size limit bypass via async fileFilter race condition", "description": "multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77063"], "fixes": ["2.3.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-77037", "noindex": false, "published": "2026-08-28T19:44:23.501Z", "modified": "2026-08-31T18:41:28.652Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00347, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-77037", "title": "multer vulnerable to Denial of Service via file descriptor leak on aborted uploads", "description": "multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77037"], "fixes": ["2.3.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-5038", "noindex": false, "published": "2026-06-15T14:23:24.230Z", "modified": "2026-06-15T16:07:45.114Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00488, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-5038", "title": "multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads", "description": "Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to \nthe underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required.\n\nPatches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path.\n\nWorkarounds: None.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5038"], "fixes": ["2.2.0", "3.0.0-alpha.2"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}, {"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-5079", "noindex": false, "published": "2026-06-15T13:56:45.520Z", "modified": "2026-06-15T16:00:43.955Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00488, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-5079", "title": "multer vulnerable to Denial of Service via deeply nested field names", "description": "Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.\n\nPatches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.\n\nWorkarounds: ", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5079"], "fixes": ["2.2.0", "3.0.0-alpha.2"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}, {"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-3520", "noindex": false, "published": "2026-03-04T16:17:18.962Z", "modified": "2026-07-15T01:03:04.430Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00998, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-3520", "title": "Multer vulnerable to Denial of Service via uncontrolled recursion", "description": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2", "https://www.cve.org/CVERecord?id=CVE-2026-3520", "https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752"], "fixes": ["2.1.1"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-3304", "noindex": false, "published": "2026-02-27T15:44:37.187Z", "modified": "2026-07-15T01:07:21.678Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00881, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-3304", "title": "Multer vulnerable to Denial of Service via incomplete cleanup", "description": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p", "https://www.cve.org/CVERecord?id=CVE-2026-3304", "https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee"], "fixes": ["2.1.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2026-2359", "noindex": false, "published": "2026-02-27T15:42:08.088Z", "modified": "2026-07-15T01:18:16.179Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0069, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-2359", "title": "Multer vulnerable to Denial of Service via resource exhaustion", "description": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc", "https://www.cve.org/CVERecord?id=CVE-2026-2359", "https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab"], "fixes": ["2.1.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2025-7338", "noindex": false, "published": "2025-07-17T15:26:45.427Z", "modified": "2025-07-17T16:48:43.154Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00808, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-7338", "title": "Multer vulnerable to Denial of Service via unhandled exception from malformed request", "description": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p", "https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b", "https://cna.openjsf.org/security-advisories.html"], "fixes": ["2.0.2"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2025-48997", "noindex": false, "published": "2025-06-03T18:21:59.527Z", "modified": "2025-06-03T18:30:13.178Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-48997", "title": "Multer vulnerable to Denial of Service via unhandled exception", "description": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg", "https://github.com/expressjs/multer/issues/1233", "https://github.com/expressjs/multer/pull/1256"], "fixes": ["2.0.1"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2025-47944", "noindex": false, "published": "2025-05-19T19:20:45.401Z", "modified": "2025-05-20T13:13:49.579Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00811, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-47944", "title": "Multer vulnerable to Denial of Service from maliciously crafted requests", "description": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h", "https://github.com/expressjs/multer/issues/1176", "https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"], "fixes": ["2.0.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}, {"id": "CVE-2025-47935", "noindex": false, "published": "2025-05-19T19:18:38.018Z", "modified": "2025-05-27T20:28:27.244Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00795, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-47935", "title": "Multer vulnerable to Denial of Service via memory leaks from unclosed streams", "description": "Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive", "references": ["https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5", "https://github.com/expressjs/multer/pull/1120", "https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"], "fixes": ["2.0.0"], "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}]}], "total": 15, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "multer", "path": "vulns/npm/multer", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-22T19:00:31.884Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}