{"kind": "product", "path": "vulns/pypi/sentry", "name": "sentry", "product": "sentry", "ecosystem": "PyPI", "items": [{"id": "CVE-2021-47935", "noindex": false, "published": "2026-05-10T12:43:54.239Z", "modified": "2026-10-08T15:20:51.839Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00927, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2021-47935", "title": "Sentry 8.2.0 Remote Code Execution via Pickle Deserialization", "description": "Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.", "references": ["https://www.exploit-db.com/exploits/50318", "https://sentry.io/welcome/", "https://www.vulncheck.com/advisories/sentry-remote-code-execution-via-pickle-deserialization"], "fixes": ["8.1.4", "8.2.2"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}, {"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}, {"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-42354", "noindex": false, "published": "2026-05-08T22:58:33.659Z", "modified": "2026-05-11T14:37:55.823Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00623, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-42354", "title": "Sentry: Improper authentication on SAML SSO process allows user identity linking", "description": "Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-rcmw-7mc7-3rj7", "https://github.com/getsentry/sentry/pull/113720", "https://github.com/getsentry/sentry/commit/0c67558ae7fe08738912d4c5233b53ead048da3b"], "fixes": ["26.4.1"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27197", "noindex": false, "published": "2026-02-21T04:35:14.635Z", "modified": "2026-02-24T19:00:07.663Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00494, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27197", "title": "Sentry: Improper Authentication on SAML SSO process allows user identity linking", "description": "Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation  which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-ggmg-cqg6-j45g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27197"], "fixes": ["26.2.0"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}, {"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-22146", "noindex": false, "published": "2025-01-15T19:57:59.734Z", "modified": "2025-01-15T20:44:47.931Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00615, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-22146", "title": "Improper authentication on SAML SSO process allows user impersonation in sentry", "description": "Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. The Sentry SaaS fix was deployed on Jan 14, 2025. For self hosted users; if only a single organization is allowed `(SENTRY_SINGLE_ORGANIZATION = True)`, then no action is needed. Otherwise, ", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w", "https://github.com/getsentry/sentry/pull/83407", "https://nvd.nist.gov/vuln/detail/CVE-2025-22146"], "fixes": ["25.1.0"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-53253", "noindex": false, "published": "2024-11-22T19:58:55.886Z", "modified": "2024-11-25T21:48:26.206Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00645, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-53253", "title": "Sentry's improper error handling leaks Application Integration Client Secret", "description": "Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the underlying HTTP response to the end user. This could occur under the following conditions: An app installation made use of a Search UI component with the `async` flag set to true (default: true); auser types types into the Search Component which creates a request to th", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-v5h2-q2w4-gpcx", "https://github.com/getsentry/sentry/pull/79377", "https://github.com/getsentry/sentry/pull/81038"], "fixes": ["24.11.1"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}, {"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-45605", "noindex": false, "published": "2024-09-17T19:44:50.664Z", "modified": "2024-09-18T13:19:27.312Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00386, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-45605", "title": "Improper authorization on deletion of user issue alert notifications in sentry", "description": "Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j", "https://github.com/getsentry/sentry/pull/77093", "https://github.com/getsentry/self-hosted"], "fixes": ["24.9.0"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-45606", "noindex": false, "published": "2024-09-17T19:43:18.650Z", "modified": "2024-09-18T13:20:30.270Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-45606", "title": "Improper authorization on muting of alert rules in sentry", "description": "Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project.  In our review, we have identified no instances where alerts have been muted by unauthorized parties.  A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts.  Sentry SaaS users do not need to take any action. Self-Hosted Sent", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-v345-w9f2-mpm5", "https://github.com/getsentry/sentry/pull/77016", "https://github.com/getsentry/self-hosted"], "fixes": ["24.9.0"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-41656", "noindex": false, "published": "2024-07-23T21:30:25.526Z", "modified": "2024-08-13T20:29:11.466Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00467, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-41656", "title": "Sentry vulnerable to stored Cross-Site Scripting (XSS)", "description": "Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page. Self-hosted Sentry users may be impacted in case of untrustworthy Integration platform integrations sending external issues from their side to Sentry. A patch has been released in Sentry 24.7.1. For Sentry SaaS customers, no action is needed. This has been patched on July 23, and even prior to the fix, the exploitation was not possible due to the stri", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-fm88-hc3v-3www", "https://github.com/getsentry/sentry/pull/74648", "https://github.com/getsentry/sentry/commit/5c679521f1539eabfb81287bfc30f34dbecd373e"], "fixes": ["24.7.1"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-35196", "noindex": false, "published": "2024-05-31T17:25:55.716Z", "modified": "2024-08-02T03:07:46.866Z", "cvss": 2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00575, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-35196", "title": "Slack integration leaks sensitive information in logs in Sentry", "description": "Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge requests and act as the Slack integration. The request body is leaked in log entries matching `event == \"slack.*\" && name == \"sentry.integrations.slack\" && request_data == *`. The deprecated slack verification token, will be found in the `request_data.token` key. **SaaS users** do not ", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-c2g2-gx4j-rj3j", "https://github.com/getsentry/sentry/pull/70508", "https://api.slack.com/authentication/verifying-requests-from-slack#app-management-updates"], "fixes": ["24.5.0"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-32474", "noindex": false, "published": "2024-04-18T19:50:44.541Z", "modified": "2024-08-02T02:13:39.118Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00428, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-32474", "title": "Sentry's superuser cleartext password leaked in logs", "description": "Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9", "https://github.com/getsentry/sentry/pull/66393", "https://github.com/getsentry/sentry/pull/69148"], "fixes": ["24.4.1"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-39531", "noindex": false, "published": "2023-08-09T16:09:34.265Z", "modified": "2024-10-03T15:12:18.720Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N", "severity": "medium", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-39531", "title": "Sentry vulnerable to incorrect credential validation on OAuth token requests", "description": "Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. Sentry SaaS customers do not need to take any action. Self-hosted installations should upgrade to version 23.7.2 or higher. There are no direct workarounds, but users should review applications authorized on their account and remove any th", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-hgj4-h2x3-rfx4", "https://nvd.nist.gov/vuln/detail/CVE-2023-39531"], "fixes": ["23.7.2"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-39349", "noindex": false, "published": "2023-08-07T18:27:12.396Z", "modified": "2024-10-04T19:12:12.595Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.01056, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-39349", "title": "Sentry vulnerable to privilege escalation via ApiTokensEndpoint", "description": "Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62c", "https://github.com/getsentry/sentry/pull/53850", "https://github.com/getsentry/sentry/commit/fad12c1150d1135edf9666ea72ca11bc110c1083"], "fixes": ["23.7.2"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-36826", "noindex": false, "published": "2023-07-25T18:50:42.350Z", "modified": "2024-10-03T19:25:30.691Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00634, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-36826", "title": "Sentry vulnerable to improper authorization on debug and artifact file downloads", "description": "Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any a", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8", "https://github.com/getsentry/sentry/pull/49680", "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9"], "fixes": ["23.5.2"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}, {"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-36829", "noindex": false, "published": "2023-07-06T22:08:58.922Z", "modified": "2024-11-06T16:44:37.019Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00666, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-36829", "title": "Sentry CORS misconfiguration vulnerability", "description": "Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6", "https://github.com/getsentry/sentry/pull/52276", "https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b"], "fixes": ["23.6.2"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}, {"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-23485", "noindex": false, "published": "2022-12-10T00:40:46.301Z", "modified": "2025-04-23T16:29:00.368Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L", "severity": "medium", "epss": 0.00451, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-23485", "title": "Invite code reuse via cookie manipulation in sentry", "description": "Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to dep", "references": ["https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j", "https://nvd.nist.gov/vuln/detail/CVE-2022-23485"], "fixes": ["22.11.0"], "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}]}], "total": 15, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "sentry", "path": "vulns/pypi/sentry", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:20:51.839Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}