{"kind": "product", "path": "vulns/ubuntu-25.10/unbound", "name": "unbound", "product": "unbound", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-44608", "noindex": false, "published": "2026-05-20T09:21:57.360Z", "modified": "2026-05-20T12:54:04.538Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber", "severity": "medium", "epss": 0.00255, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44608", "title": "Use after free and crash under special conditions in RPZ code", "description": "NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reade", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-44608"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44390", "noindex": false, "published": "2026-05-20T09:21:24.590Z", "modified": "2026-09-01T12:04:42.716Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00648, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44390", "title": "Unbounded name compression in certain cases causes degradation of service", "description": "NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the quer", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt", "https://access.redhat.com/security/cve/CVE-2026-44390", "https://bugzilla.redhat.com/show_bug.cgi?id=2480130"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42960", "noindex": false, "published": "2026-05-20T09:21:02.070Z", "modified": "2026-05-20T13:04:34.933Z", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber", "severity": "medium", "epss": 0.00262, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42960", "title": "Possible cache poisoning via promiscuous records for the authority section", "description": "NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attack", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-42960"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42959", "noindex": false, "published": "2026-05-20T09:20:45.766Z", "modified": "2026-09-01T12:05:00.883Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Red", "severity": "high", "epss": 0.00807, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42959", "title": "Crash during DNSSEC validation of malicious content", "description": "NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt", "https://access.redhat.com/security/cve/CVE-2026-42959", "https://bugzilla.redhat.com/show_bug.cgi?id=2479806"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42944", "noindex": false, "published": "2026-05-20T09:20:23.906Z", "modified": "2026-08-26T12:04:57.670Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Red", "severity": "high", "epss": 0.00842, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42944", "title": "Heap overflow with multiple NSID, COOKIE, PADDING EDNS options", "description": "NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Th", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt", "https://access.redhat.com/security/cve/CVE-2026-42944", "https://bugzilla.redhat.com/show_bug.cgi?id=2479774"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42923", "noindex": false, "published": "2026-05-20T09:20:01.104Z", "modified": "2026-05-20T12:10:10.747Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00339, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42923", "title": "Degradation of service with unbounded NSEC3 hash calculations", "description": "NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-42923"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42534", "noindex": false, "published": "2026-05-20T09:19:37.920Z", "modified": "2026-09-01T12:04:48.337Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00604, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42534", "title": "Jostle logic bypass degrades resolution performance", "description": "NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kic", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt", "https://access.redhat.com/security/cve/CVE-2026-42534", "https://bugzilla.redhat.com/show_bug.cgi?id=2480131"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-41292", "noindex": false, "published": "2026-05-20T09:19:13.022Z", "modified": "2026-09-01T12:04:47.614Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Red", "severity": "medium", "epss": 0.00748, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-41292", "title": "Long list of incoming EDNS options degrades performance", "description": "NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt", "https://access.redhat.com/security/cve/CVE-2026-41292", "https://bugzilla.redhat.com/show_bug.cgi?id=2480125"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-40622", "noindex": false, "published": "2026-05-20T09:18:41.816Z", "modified": "2026-05-20T12:12:33.115Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber", "severity": "medium", "epss": 0.00142, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40622", "title": "Another 'ghost domain names' attack variant", "description": "NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is use", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-40622"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-33278", "noindex": false, "published": "2026-05-20T09:18:15.225Z", "modified": "2026-09-01T12:04:59.092Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Red", "severity": "critical", "epss": 0.0142, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33278", "title": "Possible arbitrary code execution during DNSSEC validation", "description": "NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's poi", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt", "https://access.redhat.com/security/cve/CVE-2026-33278", "https://bugzilla.redhat.com/show_bug.cgi?id=2479808"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-32792", "noindex": false, "published": "2026-05-20T09:17:47.920Z", "modified": "2026-05-20T12:16:06.804Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green", "severity": "medium", "epss": 0.00337, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32792", "title": "Packet of death with DNSCrypt", "description": "NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-32792"], "fixes": ["1.22.0-2ubuntu2.3"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-11411", "noindex": false, "published": "2025-10-22T12:28:02.607Z", "modified": "2025-12-05T10:56:13.103Z", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P", "severity": "medium", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-11411", "title": "Possible domain hijacking via promiscuous records in the authority section", "description": "NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt", "https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html", "http://www.openwall.com/lists/oss-security/2025/11/26/4"], "fixes": ["1.22.0-2ubuntu2.2"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-5994", "noindex": false, "published": "2025-07-16T14:38:22.738Z", "modified": "2025-11-03T18:13:56.352Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/R:U/V:C", "severity": "high", "epss": 0.00218, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-5994", "title": "Cache poisoning via the ECS-enabled Rebirthday Attack", "description": "A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match ", "references": ["https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt", "https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-5994"], "fixes": ["1.22.0-2ubuntu1"], "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}]}], "total": 13, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "unbound", "path": "vulns/ubuntu-25.10/unbound", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-01T12:05:00.883Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}