{"kind": "product", "path": "vulns/debian-14/nsd", "name": "nsd", "product": "nsd", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-101341", "noindex": false, "published": "2026-10-14T10:56:51.922Z", "modified": "2026-10-14T14:08:20.283Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00335, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101341", "title": "Stack overwrite from specially formatted TXT-DATA RDATA field", "description": "Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse.  Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-101341"], "fixes": ["4.15.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-101339", "noindex": false, "published": "2026-10-14T10:56:37.808Z", "modified": "2026-10-14T14:08:51.522Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101339", "title": "Stack overwrite from a specially crafted and formatted HIP RR", "description": "A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-101339"], "fixes": ["4.15.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-101338", "noindex": false, "published": "2026-10-14T10:56:28.223Z", "modified": "2026-10-14T14:09:20.163Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101338", "title": "Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR", "description": "When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-101338"], "fixes": ["4.15.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-101337", "noindex": false, "published": "2026-10-14T10:56:15.073Z", "modified": "2026-10-14T14:09:58.370Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101337", "title": "Stack overwrite from specially formatted base64 RDATA field", "description": "When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-101337"], "fixes": ["4.15.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-19538", "noindex": false, "published": "2026-08-26T08:47:08.992Z", "modified": "2026-08-26T14:00:12.918Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00259, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19538", "title": "Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS", "description": "The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-19538"], "fixes": ["4.15.1-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-19401", "noindex": false, "published": "2026-08-26T08:44:08.078Z", "modified": "2026-08-26T14:16:26.813Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19401", "title": "Remote UDP DoS by sending multiple DNS Cookie options", "description": "Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-19401"], "fixes": ["4.15.1-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-18916", "noindex": false, "published": "2026-08-26T08:39:12.258Z", "modified": "2026-08-26T14:22:31.309Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18916", "title": "Remote TCP DoS by throttling the TCP receive window", "description": "Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18916.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-18916"], "fixes": ["4.15.1-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-18664", "noindex": false, "published": "2026-08-26T08:34:22.871Z", "modified": "2026-08-26T14:47:35.523Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00259, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18664", "title": "Wrong interpretation of ACL ranges", "description": "When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian).  With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18664.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-18664"], "fixes": ["4.15.1-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-12490", "noindex": false, "published": "2026-06-25T05:24:41.814Z", "modified": "2026-06-25T12:41:18.144Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00216, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12490", "title": "Bypass of client certificate verification with transfer over TLS", "description": "When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-12490"], "fixes": ["4.14.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-12246", "noindex": false, "published": "2026-06-25T05:24:29.512Z", "modified": "2026-06-25T12:42:05.428Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00444, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12246", "title": "Out of bounds stack write with crafted APL RR", "description": "NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-12246"], "fixes": ["4.14.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-12245", "noindex": false, "published": "2026-06-25T05:24:18.620Z", "modified": "2026-06-25T12:42:50.104Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12245", "title": "Denial of DNS over TLS service by any DoT client", "description": "NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-12245"], "fixes": ["4.14.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-12244", "noindex": false, "published": "2026-06-25T05:24:08.548Z", "modified": "2026-06-25T12:45:34.403Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00487, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12244", "title": "Heap overflow and crash with crafted SVCB RR", "description": "If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes", "references": ["https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-12244"], "fixes": ["4.14.3-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2020-28935", "noindex": false, "published": "2020-12-07T21:46:47.878Z", "modified": "2024-09-16T23:27:01.127Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00494, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-28935", "title": "Local symlink attack in Unbound and NSD", "description": "NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt", "https://www.nlnetlabs.nl/downloads/nsd/CVE-2020-28935.txt", "https://security.gentoo.org/glsa/202101-38"], "fixes": ["4.3.4-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2019-13207", "noindex": false, "published": "2019-07-03T19:49:12.000Z", "modified": "2024-08-04T23:41:10.502Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02026, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-13207", "title": "CVE-2019-13207", "description": "nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.", "references": ["https://github.com/NLnetLabs/nsd/issues/20", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS4H7WVHQGCX3LF72F5K22VJXN7HDBB/", "https://nvd.nist.gov/vuln/detail/CVE-2019-13207"], "fixes": ["4.2.4-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2016-6173", "noindex": false, "published": "2017-02-09T15:00:00.000Z", "modified": "2024-08-06T01:22:20.777Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02916, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-6173", "title": "CVE-2016-6173", "description": "NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.", "references": ["https://open.nlnetlabs.nl/pipermail/nsd-users/2016-August/002342.html", "http://www.openwall.com/lists/oss-security/2016/07/06/3", "http://www.securityfocus.com/bid/91678"], "fixes": ["4.1.11-1"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2009-1755", "noindex": false, "published": "2009-05-22T01:00:00.000Z", "modified": "2024-09-17T03:23:44.786Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.03157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2009-1755", "title": "CVE-2009-1755", "description": "Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.", "references": ["http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529420", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529418"], "fixes": ["2.3.7-3"], "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}]}], "total": 16, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nsd", "path": "vulns/debian-14/nsd", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-14T14:09:58.370Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}