{"kind": "product", "path": "vulns/debian-14/composer", "name": "composer", "product": "composer", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-59944", "noindex": false, "published": "2026-09-16T16:09:43.258Z", "modified": "2026-09-16T17:29:39.824Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.0047, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59944", "title": "Composer: CVE-2026-59946 fix bypass via symlinked package bin path", "description": "Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin e", "references": ["https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776", "https://github.com/composer/composer/commit/53b8bb4c24697b2f00a18cf1ef35a10392701b89", "https://github.com/composer/composer/commit/ad649fdfdf8ed826d4a34e0e5690c76a0b4833aa"], "fixes": ["2.10.3-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-84361", "noindex": false, "published": "2026-09-01T20:06:48.375Z", "modified": "2026-09-03T03:56:08.149Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00502, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-84361", "title": "Composer: Perforce source URL permits P4PORT `rsh:` command execution", "description": "Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\\Util\\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is", "references": ["https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3", "https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220", "https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af"], "fixes": ["2.10.3-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-45793", "noindex": false, "published": "2026-07-15T16:22:19.418Z", "modified": "2026-07-15T18:11:10.355Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.01021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45793", "title": "Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs", "description": "Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2", "https://github.com/composer/composer/pull/12853", "https://github.com/composer/composer/pull/12855"], "fixes": ["2.10.0-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-59947", "noindex": false, "published": "2026-07-08T19:33:56.009Z", "modified": "2026-07-09T14:01:42.612Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0012, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59947", "title": "Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)", "description": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3", "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8", "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"], "fixes": ["2.10.2-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-59948", "noindex": false, "published": "2026-07-08T19:33:48.414Z", "modified": "2026-07-09T14:32:07.719Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00138, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59948", "title": "Composer: Arbitrary file write outside vendor via malicious transitive package name", "description": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9", "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0", "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"], "fixes": ["2.10.2-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-59946", "noindex": false, "published": "2026-07-08T19:32:38.089Z", "modified": "2026-07-09T14:41:23.436Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00141, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59946", "title": "Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files", "description": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx", "https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0", "https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1"], "fixes": ["2.10.2-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-40261", "noindex": false, "published": "2026-04-15T20:56:32.182Z", "modified": "2026-07-15T01:01:10.106Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01688, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40261", "title": "Composer has Command Injection via Malicious Perforce Reference", "description": "Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied Perforce connection parameters (port, user, client) from the source url field without proper escaping. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce ", "references": ["https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q", "https://github.com/composer/composer/releases/tag/2.9.6", "https://access.redhat.com/security/cve/CVE-2026-40261"], "fixes": ["2.9.7-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-40176", "noindex": false, "published": "2026-04-15T20:47:39.839Z", "modified": "2026-07-15T01:01:19.144Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01045, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40176", "title": "Composer is vulnerable to Command Injection via Malicious Perforce Repository", "description": "Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory", "references": ["https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p", "https://github.com/composer/composer/releases/tag/2.9.6", "https://access.redhat.com/security/cve/CVE-2026-40176"], "fixes": ["2.9.7-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-67746", "noindex": false, "published": "2025-12-30T16:11:04.776Z", "modified": "2025-12-30T17:30:04.562Z", "cvss": 1.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00453, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-67746", "title": "Composer vulnerable to ANSI sequence injection", "description": "Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g", "https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917", "https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71"], "fixes": ["2.9.3-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-35242", "noindex": false, "published": "2024-06-10T21:23:44.040Z", "modified": "2025-02-13T17:52:34.786Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.03282, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-35242", "title": "Composer vulnerable to command injection via malicious git/hg branch names", "description": "Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf", "https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396", "https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467"], "fixes": ["2.7.7-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-35241", "noindex": false, "published": "2024-06-10T21:19:47.123Z", "modified": "2025-04-21T15:20:35.089Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0105, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-35241", "title": "Composer vulnerable to command injection via malicious git branch name", "description": "Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c", "https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4", "https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704"], "fixes": ["2.7.7-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-24821", "noindex": false, "published": "2024-02-08T23:54:04.058Z", "modified": "2025-06-17T21:29:29.230Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00279, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-24821", "title": "Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer", "description": "Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Sha", "references": ["https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h", "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5", "https://nvd.nist.gov/vuln/detail/CVE-2024-24821"], "fixes": ["2.7.1-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-43655", "noindex": false, "published": "2023-09-29T19:33:32.183Z", "modified": "2025-06-18T13:59:58.568Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.01532, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-43655", "title": "Remote Code Execution via web-accessible composer.phar", "description": "Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.", "references": ["https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf", "https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d", "https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c"], "fixes": ["2.6.4-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2015-8371", "noindex": false, "published": "2023-09-21T00:00:00.000Z", "modified": "2024-09-25T13:30:18.745Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.00723, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2015-8371", "title": "CVE-2015-8371", "description": "Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.", "references": ["https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html", "https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE-2015-8371.yaml", "https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml"], "fixes": ["1.0.0~alpha11-3"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-24828", "noindex": false, "published": "2022-04-13T21:00:22.000Z", "modified": "2025-04-23T18:40:09.513Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.01886, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24828", "title": "Missing input validation can lead to command execution in composer", "description": "Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileConte", "references": ["https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6", "https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709", "https://www.tenable.com/security/tns-2022-09"], "fixes": ["2.2.12-1"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-29472", "noindex": false, "published": "2021-04-27T20:30:15.000Z", "modified": "2024-08-03T22:11:05.384Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.04752, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-29472", "title": "Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer", "description": "Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist.org a", "references": ["https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx", "https://getcomposer.org/", "https://www.debian.org/security/2021/dsa-4907"], "fixes": ["2.0.9-2"], "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}]}], "total": 16, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "composer", "path": "vulns/debian-14/composer", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-16T17:29:39.824Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}