{"kind": "product", "path": "vulns/npm/next-auth", "name": "next-auth", "product": "next-auth", "ecosystem": "npm", "items": [{"id": "CVE-2026-73421", "noindex": false, "published": "2026-08-13T22:04:36.985Z", "modified": "2026-08-18T01:45:41.913Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00643, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73421", "title": "NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)", "description": "NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or an", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3", "https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f", "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"], "fixes": ["5.0.0-beta.32"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-73420", "noindex": false, "published": "2026-08-13T22:04:15.414Z", "modified": "2026-08-14T15:06:00.594Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00725, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73420", "title": "NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass", "description": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless ", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh", "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94", "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"], "fixes": ["4.24.15", "5.0.0-beta.32"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-73419", "noindex": false, "published": "2026-08-12T20:23:39.174Z", "modified": "2026-08-13T15:32:15.689Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00249, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73419", "title": "NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them", "description": "NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authori", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279", "https://github.com/nextauthjs/next-auth/pull/13469", "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"], "fixes": ["4.24.15", "5.0.0-beta.32"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-73418", "noindex": false, "published": "2026-08-12T20:21:11.318Z", "modified": "2026-08-13T12:53:44.683Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00877, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73418", "title": "NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers", "description": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled ex", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj", "https://github.com/nextauthjs/next-auth/pull/13469", "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"], "fixes": ["4.24.15", "5.0.0-beta.32"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "GHSA-5jpx-9hw9-2fx4", "noindex": false, "published": "2025-10-29T10:43:57Z", "modified": "2026-09-10T03:50:29.281362473Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-5jpx-9hw9-2fx4", "title": "NextAuthjs Email misdelivery Vulnerability", "description": "### Summary\n\nNextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as:\n\n```\n\"e@attacker.com\"@victim.com\n```\n\nis parsed incorrectly and results in the message being delivered to `e@attacker.com` (attacker) instead of `\"<e@attacker.com>@victim.com\"` (the intended recipient at `victim.com`) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.\n\n<h2>Affected NextAuthjs Versio", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-5jpx-9hw9-2fx4", "https://github.com/nextauthjs/next-auth/commit/82efcf81f218aae43683f8dd2f7c260ef69b3ece", "https://github.com/nextauthjs/next-auth/commit/8f3b2c7af0fe08973a12f616517c3ec85a5cd172"], "fixes": ["4.24.12", "5.0.0-beta.30"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2023-48309", "noindex": false, "published": "2023-11-20T18:25:01.896Z", "modified": "2024-08-29T13:41:03.796Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.007, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-48309", "title": "next-auth vulnerable to possible user mocking that bypasses basic authentication", "description": "NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow (state, PKCE or nonce). Manually overriding the `next-auth.session-token` cookie value with this non-related JWT would let the user simulate a logged in user, albeit having no user information associated with it. (The only property on this user is an opaque randomly generated string). This vulnerability does not give access to other users'", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-v64w-49xw-qq89", "https://github.com/nextauthjs/next-auth/commit/d237059b6d0cb868c041ba18b698e0cee20a2f10", "https://authjs.dev/guides/basics/role-based-access-control"], "fixes": ["4.24.5"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2023-27490", "noindex": false, "published": "2023-03-09T20:37:11.407Z", "modified": "2025-02-25T14:59:02.632Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00538, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-27490", "title": "Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth", "description": "NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised ", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf", "https://authjs.dev/reference/core/providers#checks", "https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/"], "fixes": ["4.20.1"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2022-35924", "noindex": false, "published": "2022-08-02T17:55:13.000Z", "modified": "2025-04-23T17:54:19.705Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.01471, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-35924", "title": "Verification requests (magic link) sent to unwanted emails", "description": "NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-separated list of emails (eg.: `attacker@attacker.com,victim@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being `attacker@attacker.com,victim@victim.com`. This means that basic authorization like `email.endsWith(\"@victim.com\")` in the `signIn` c", "references": ["https://next-auth.js.org/configuration/initialization#advanced-initialization", "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587", "https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003"], "fixes": ["3.29.10", "4.10.3"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2022-31186", "noindex": false, "published": "2022-08-01T19:25:24.000Z", "modified": "2025-04-23T17:56:16.785Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00256, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-31186", "title": "Leakage of excessive information into log in next-auth", "description": "NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` optio", "references": ["https://next-auth.js.org/getting-started/upgrade-v4", "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p", "https://next-auth.js.org/configuration/options#logger"], "fixes": ["3.29.9", "4.10.2"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2022-31127", "noindex": false, "published": "2022-07-06T18:00:16.000Z", "modified": "2025-04-22T17:51:28.600Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "severity": "high", "epss": 0.01132, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-31127", "title": "Improper handling of email input in next-auth", "description": "NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `balazs@email.com, <a href=\"http://attacker.com\">Before signing in, claim your money!</a>`. This was previously sent to `balazs@email.com`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following relea", "references": ["https://next-auth.js.org/getting-started/upgrade-v4", "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463", "https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c"], "fixes": ["3.29.8", "4.9.0"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2022-31093", "noindex": false, "published": "2022-06-27T21:30:20.000Z", "modified": "2025-04-23T18:06:46.737Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.01748, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-31093", "title": "Improper Handling of `callbackUrl` parameter in next-auth", "description": "NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentati", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432", "https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85", "https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6"], "fixes": ["3.29.5", "4.5.0"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2022-29214", "noindex": false, "published": "2022-05-20T23:45:11.000Z", "modified": "2025-04-23T18:23:37.970Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0067, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-29214", "title": "URL Redirection to Untrusted Site ('Open Redirect') in next-auth", "description": "NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain a patch for this issue. The maintainers recommend adding a certain configuration to one's `callbacks` option as a workaround for those unable to upgrade.", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-q2mx-j4x2-2h74", "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.3", "https://nvd.nist.gov/vuln/detail/CVE-2022-29214"], "fixes": ["3.29.3", "4.3.3"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2022-24858", "noindex": false, "published": "2022-04-19T22:25:10.000Z", "modified": "2025-04-23T18:33:56.817Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.0079, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-24858", "title": "Default redirect callback vulnerable to open redirects", "description": "next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw", "https://next-auth.js.org/configuration/callbacks#redirect-callback", "https://next-auth.js.org/getting-started/upgrade-v4"], "fixes": ["3.29.2", "4.3.2"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}, {"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}, {"id": "CVE-2021-21310", "noindex": false, "published": "2021-02-11T21:40:16.000Z", "modified": "2024-08-03T18:09:15.328Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.01667, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2021-21310", "title": "Token verification bug in next-auth", "description": "NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sig", "references": ["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q", "https://www.npmjs.com/package/next-auth", "https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0"], "fixes": ["3.3.0"], "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "next-auth", "path": "vulns/npm/next-auth", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T03:50:29.281362473Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}