{"kind": "product", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "name": "htslib", "product": "htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS", "items": [{"id": "CVE-2026-116742", "noindex": false, "published": "2026-10-26T21:52:41.511Z", "modified": "2026-10-27T14:16:48.820Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00123, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116742", "title": "HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count", "description": "HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.", "references": ["https://github.com/samtools/htslib/pull/2057", "https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873", "https://github.com/samtools/htslib"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31971", "noindex": false, "published": "2026-03-18T19:55:20.379Z", "modified": "2026-03-18T20:15:22.414Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31971", "title": "HTSlib CRAM decoder vulnerable to buffer overflow", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the `BYTE_ARRAY_LEN` method, the `cram_byte_array_len_decode()` failed to validate that the amount of data being unpacked matched the size of the output buffer where it was to be stored. Depending on the data series being read, this could result either in a heap or a stack overflow with attacker-controlled bytes. Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a u", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-jvx4-4wq7-6fmh", "https://github.com/samtools/htslib/commit/01cd003b46fa2ebea4d9be5475b11217eb4c11be", "https://nvd.nist.gov/vuln/detail/CVE-2026-31971"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31970", "noindex": false, "published": "2026-03-18T19:53:18.719Z", "modified": "2026-03-18T23:08:18.668Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31970", "title": "HTSlib BGZF index file reader has a heap buffer overflow", "description": "HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files.  In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index.  Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well.  If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed hea", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q", "https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828", "http://www.openwall.com/lists/oss-security/2026/03/18/9"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31969", "noindex": false, "published": "2026-03-18T19:47:44.893Z", "modified": "2026-03-18T20:12:53.495Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31969", "title": "HTSlib CRAM decoder has a heap buffer overflow", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods.  When reading data encoded using the `BYTE_ARRAY_STOP` method, an out-by-one error in the `cram_byte_array_stop_decode_char()` function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-q4cj-f4h5-fqgc", "https://github.com/samtools/htslib/commit/88cdf69e4b83bb550ab4f6f7134892c2ad1978f4", "https://nvd.nist.gov/vuln/detail/CVE-2026-31969"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31968", "noindex": false, "published": "2026-03-18T19:38:11.370Z", "modified": "2026-03-18T19:57:36.668Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00425, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31968", "title": "HTSlib CRAM decoder vulnerable to buffer overflow", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. For the `VARINT` and `CONST` encodings, incomplete validation of the context in which the encodings were used could result in up to eight bytes being written beyond the end of a heap allocation, or up to eight bytes being written to the location of a one byte variable on the stack, possibly causing the values to adjacent variables to change unexpectedly. Depending on the data stream this could result either in a heap buffer overflow or a stack overfl", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-cgcm-c9r2-p57j", "https://github.com/samtools/htslib/commit/0ec436796eca7b4ce7fcc9b77270c102da29bb2e", "https://nvd.nist.gov/vuln/detail/CVE-2026-31968"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31967", "noindex": false, "published": "2026-03-18T19:15:48.891Z", "modified": "2026-03-18T19:58:55.083Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00462, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31967", "title": "HTSlib CRAM reader has out-of-bounds read due to improper validation of input", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, the value of the mate reference id field was not validated. Later use of this value, for example when converting the data to SAM format, could result in the out of bounds array reads when looking up the corresponding reference name. If the array value obtained also happened to be a valid pointer, it would be interpreted as a string and an attempt would be made to write the data as part of the SAM record. This bug may allow informa", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-33x5-c6vj-8f2w", "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357", "https://nvd.nist.gov/vuln/detail/CVE-2026-31967"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31966", "noindex": false, "published": "2026-03-18T18:58:47.090Z", "modified": "2026-03-18T19:58:26.525Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00538, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31966", "title": "HTSlib CRAM reader has out-of-bounds read due to improper validation of input", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data s", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3", "https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28", "https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31965", "noindex": false, "published": "2026-03-18T18:50:37.333Z", "modified": "2026-03-19T14:52:36.357Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31965", "title": "HTSlib CRAM reader has out-of-bounds reads due to improper validation of input", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is ", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr", "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357", "https://nvd.nist.gov/vuln/detail/CVE-2026-31965"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31964", "noindex": false, "published": "2026-03-18T18:27:26.099Z", "modified": "2026-03-18T18:46:29.177Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00335, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31964", "title": "HTSlib CRAM decoder has a NULL Pointer Dereference", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods.  While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the `CONST`, `XPACK` and `XRLE` encodings did not properly implement the interface needed to do this. Trying to decode record", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-5w97-85gf-86rm", "https://github.com/samtools/htslib/commit/e64e68da567d2309509d059ace016d5d7fc7514f", "https://nvd.nist.gov/vuln/detail/CVE-2026-31964"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31963", "noindex": false, "published": "2026-03-18T18:22:58.440Z", "modified": "2026-03-18T18:52:43.260Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00361, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31963", "title": "HTSlib CRAM reader has heap buffer overflow due to improper validation of input", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyo", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c", "https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd", "https://nvd.nist.gov/vuln/detail/CVE-2026-31963"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-31962", "noindex": false, "published": "2026-03-18T18:08:26.067Z", "modified": "2026-03-18T18:37:22.954Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00375, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31962", "title": "HTSlib CRAM reader has heap buffer overflow due to improper validation of input", "description": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the `cram_decode_seq()` did not handle this correctly in some cases. Where this happened it could result in reading a single byte from beyond the end of a heap allocation, followe", "references": ["https://github.com/samtools/htslib/security/advisories/GHSA-xxmp-v7h3-gpwp", "https://github.com/samtools/htslib/commit/d799b54c6401879187bba4741be83ff590ac73e3", "https://nvd.nist.gov/vuln/detail/CVE-2026-31962"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2020-36403", "noindex": false, "published": "2021-07-01T02:51:43.000Z", "modified": "2024-08-04T17:23:10.582Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01593, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-36403", "title": "CVE-2020-36403", "description": "HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).", "references": ["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097", "https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c", "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yaml"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2018-14329", "noindex": false, "published": "2018-07-17T02:00:00.000Z", "modified": "2024-08-05T09:21:41.621Z", "cvss": 4.7, "cvss_vector": "", "severity": "medium", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-14329", "title": "CVE-2018-14329", "description": "In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.", "references": ["https://github.com/samtools/htslib/issues/736", "https://nvd.nist.gov/vuln/detail/CVE-2018-14329"], "fixes": [], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2018-13845", "noindex": false, "published": "2018-07-10T18:00:00.000Z", "modified": "2024-08-05T09:14:47.264Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.01695, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-13845", "title": "CVE-2018-13845", "description": "An issue has been found in HTSlib 1.8. It is a buffer over-read in sam_parse1 in sam.c.", "references": ["https://github.com/samtools/htslib/issues/731#issuecomment-403681105", "https://nvd.nist.gov/vuln/detail/CVE-2018-13845"], "fixes": ["0.2.0~rc3-1ubuntu0.1~esm1"], "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "htslib", "path": "vulns/ubuntu-pro-14.04-lts/htslib", "ecosystem": "Ubuntu:Pro:14.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-27T14:16:48.820Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}