{"kind": "product", "path": "vulns/debian-13/swupdate", "name": "swupdate", "product": "swupdate", "ecosystem": "Debian:13", "items": [{"id": "CVE-2025-41259", "noindex": false, "published": "2026-06-03T11:01:59.871Z", "modified": "2026-06-03T12:37:01.661Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00101, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-41259", "title": "SWUpdate Untrusted Script Execution via Signed Update TOCTOU", "description": "SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.", "references": ["https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251206-01_SWUpdate_Untrusted_Script_Execution_via_Signed_Update_TOCTOU", "https://github.com/sbabic/swupdate/commit/f4bd64260e233e207354d68d572b1cbc3e63689d", "https://github.com/sbabic/swupdate"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-6986", "noindex": false, "published": "2026-04-25T16:30:13.067Z", "modified": "2026-04-27T13:36:06.578Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00217, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6986", "title": "Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification", "description": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed", "references": ["https://vuldb.com/vuln/359529", "https://vuldb.com/vuln/359529/cti", "https://vuldb.com/submit/796231"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-6985", "noindex": false, "published": "2026-04-25T16:15:13.639Z", "modified": "2026-04-27T12:35:36.821Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00565, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6985", "title": "Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop", "description": "A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.", "references": ["https://vuldb.com/vuln/359528", "https://vuldb.com/vuln/359528/cti", "https://vuldb.com/submit/796230"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-28525", "noindex": false, "published": "2026-04-23T20:59:31.492Z", "modified": "2026-07-28T01:48:29.666Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00316, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28525", "title": "SWUpdate Integer Underflow in Multipart Upload Parser", "description": "SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.", "references": ["https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74", "https://www.vulncheck.com/advisories/swupdate-integer-underflow-in-multipart-upload-parser", "https://nvd.nist.gov/vuln/detail/CVE-2026-28525"], "fixes": ["2024.12.1+dfsg-3+deb13u2"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-5246", "noindex": false, "published": "2026-04-02T09:45:11.602Z", "modified": "2026-04-02T13:07:02.788Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00622, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5246", "title": "Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization", "description": "A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professi", "references": ["https://vuldb.com/vuln/354827", "https://vuldb.com/vuln/354827/cti", "https://vuldb.com/submit/770104"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-5245", "noindex": false, "published": "2026-04-02T09:00:19.688Z", "modified": "2026-04-02T14:27:27.092Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00716, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5245", "title": "Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow", "description": "A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very ", "references": ["https://vuldb.com/vuln/354826", "https://vuldb.com/vuln/354826/cti", "https://vuldb.com/submit/770103"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-5244", "noindex": false, "published": "2026-04-02T08:00:19.770Z", "modified": "2026-04-02T13:31:54.915Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00727, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5244", "title": "Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow", "description": "A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.", "references": ["https://vuldb.com/vuln/354825", "https://vuldb.com/vuln/354825/cti", "https://vuldb.com/submit/770063"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-2968", "noindex": false, "published": "2026-02-23T03:02:07.673Z", "modified": "2026-02-23T17:26:53.648Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00254, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2968", "title": "Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification", "description": "A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the component Poly1305 Authentication Tag Handler. The manipulation results in improper verification of cryptographic signature. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/?id.347335", "https://vuldb.com/?ctiid.347335", "https://vuldb.com/?submit.757091"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-2967", "noindex": false, "published": "2026-02-23T02:32:07.568Z", "modified": "2026-02-23T13:32:57.830Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00575, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2967", "title": "Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source", "description": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/?id.347334", "https://vuldb.com/?ctiid.347334", "https://vuldb.com/?submit.755450"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-2966", "noindex": false, "published": "2026-02-23T02:02:08.202Z", "modified": "2026-02-23T13:36:51.905Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00441, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2966", "title": "Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values", "description": "A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/?id.347333", "https://vuldb.com/?ctiid.347333", "https://vuldb.com/?submit.755304"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-65502", "noindex": false, "published": "2025-11-24T00:00:00.000Z", "modified": "2025-11-24T18:29:36.744Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00303, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-65502", "title": "CVE-2025-65502", "description": "Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.", "references": ["https://github.com/cesanta/mongoose/issues/3306", "https://github.com/cesanta/mongoose/pull/3307", "https://nvd.nist.gov/vuln/detail/CVE-2025-65502"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-51495", "noindex": false, "published": "2025-09-29T00:00:00.000Z", "modified": "2025-10-01T15:21:21.511Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00424, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-51495", "title": "CVE-2025-51495", "description": "An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.", "references": ["https://github.com/cesanta/mongoose", "https://github.com/cesanta/mongoose/pull/3131", "https://github.com/cainiao159357/CVE-2025-51495"], "fixes": [], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-25887", "noindex": false, "published": "2023-08-22T00:00:00.000Z", "modified": "2024-10-03T19:29:25.195Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.00703, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-25887", "title": "CVE-2020-25887", "description": "Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.", "references": ["https://github.com/cesanta/mongoose/issues/1140", "https://nvd.nist.gov/vuln/detail/CVE-2020-25887"], "fixes": ["2022.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2023-2905", "noindex": false, "published": "2023-08-09T04:46:14.972Z", "modified": "2024-10-10T14:56:29.619Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01006, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-2905", "title": "Cesanta Mongoose MQTT Message Parsing Heap Overflow", "description": "Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.\n", "references": ["https://takeonme.org/cves/CVE-2023-2905.html", "https://github.com/cesanta/mongoose/pull/2274", "https://github.com/cesanta/mongoose/releases/tag/7.11"], "fixes": ["2024.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2023-34188", "noindex": false, "published": "2023-06-23T00:00:00.000Z", "modified": "2025-02-28T13:07:27.141Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.01005, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-34188", "title": "CVE-2023-34188", "description": "The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.", "references": ["https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f", "https://github.com/cesanta/mongoose/pull/2197", "https://github.com/cesanta/mongoose/compare/7.9...7.10"], "fixes": ["2024.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-26530", "noindex": false, "published": "2021-02-08T20:13:36.000Z", "modified": "2024-08-03T20:26:25.462Z", "cvss": 9.1, "cvss_vector": "", "severity": "critical", "epss": 0.0149, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-26530", "title": "CVE-2021-26530", "description": "The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.", "references": ["https://github.com/cesanta/mongoose/issues/1204", "https://nvd.nist.gov/vuln/detail/CVE-2021-26530"], "fixes": ["2022.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-26529", "noindex": false, "published": "2021-02-08T20:13:36.000Z", "modified": "2024-08-03T20:26:25.389Z", "cvss": 9.1, "cvss_vector": "", "severity": "critical", "epss": 0.0149, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-26529", "title": "CVE-2021-26529", "description": "The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.", "references": ["https://github.com/cesanta/mongoose/issues/1203", "https://nvd.nist.gov/vuln/detail/CVE-2021-26529"], "fixes": ["2022.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-26528", "noindex": false, "published": "2021-02-08T20:13:36.000Z", "modified": "2024-08-03T20:26:25.531Z", "cvss": 9.1, "cvss_vector": "", "severity": "critical", "epss": 0.0149, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-26528", "title": "CVE-2021-26528", "description": "The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.", "references": ["https://github.com/cesanta/mongoose/issues/1201", "https://nvd.nist.gov/vuln/detail/CVE-2021-26528"], "fixes": ["2022.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-25756", "noindex": false, "published": "2020-09-18T04:44:50.000Z", "modified": "2024-08-04T15:40:36.991Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.01616, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-25756", "title": "CVE-2020-25756", "description": "A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated \"this will not happen in practice.", "references": ["https://github.com/cesanta/mongoose/issues/1135", "https://nvd.nist.gov/vuln/detail/CVE-2020-25756"], "fixes": ["2022.12+dfsg-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}, {"id": "CVE-2019-19307", "noindex": false, "published": "2019-11-26T15:15:04.000Z", "modified": "2024-08-05T02:16:46.823Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.42246, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-19307", "title": "CVE-2019-19307", "description": "An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.", "references": ["https://github.com/cesanta/mongoose/issues/1055", "https://nvd.nist.gov/vuln/detail/CVE-2019-19307"], "fixes": ["2021.04-1"], "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}]}], "total": 22, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "swupdate", "path": "vulns/debian-13/swupdate", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-28T01:48:29.666Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}