{"kind": "product", "path": "vulns/debian-13/libsixel", "name": "libsixel", "product": "libsixel", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-110601", "noindex": false, "published": "2026-10-14T14:16:43.022Z", "modified": "2026-10-20T01:04:11.699Z", "cvss": 5.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00236, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110601", "title": "libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF", "description": "libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.", "references": ["https://github.com/saitoha/libsixel/issues/220", "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047", "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-44637", "noindex": false, "published": "2026-05-14T20:02:32.034Z", "modified": "2026-05-15T13:35:45.953Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44637", "title": "libsixel: integer overflow in parser", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression \"pos_x + repeat_count\" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data a", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv", "https://nvd.nist.gov/vuln/detail/CVE-2026-44637"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-44636", "noindex": false, "published": "2026-05-14T20:01:27.050Z", "modified": "2026-05-16T03:56:20.840Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00104, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44636", "title": "libsixel: integer overflow in encoder", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succee", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-hx93-w8p2-ffh5", "https://nvd.nist.gov/vuln/detail/CVE-2026-44636"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-44638", "noindex": false, "published": "2026-05-14T19:59:29.704Z", "modified": "2026-05-15T14:18:03.581Z", "cvss": 2.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00131, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44638", "title": "libsixel: NULL pointer dereference", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w", "https://nvd.nist.gov/vuln/detail/CVE-2026-44638"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-33023", "noindex": false, "published": "2026-04-14T22:05:31.493Z", "modified": "2026-04-15T20:02:36.839Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00289, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33023", "title": "libsixel: Use-after-free in load_with_gdkpixbuf()", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built with the --with-gdk-pixbuf2 option, a use-after-free vulnerability exists in load_with_gdkpixbuf() in loader.c. The cleanup path manually frees the sixel_frame_t object and its internal buffers without consulting the reference count, even though the object was created via the refcounted constructor sixel_frame_new() and exposed to the public callback. A callback that calls sixel_frame_ref(frame) to retain a logically valid reference will hold a dangling pointer after sixel_helper_load_image_file() returns, and any subsequent ", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-hr25-g2j6-qjw6", "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "https://nvd.nist.gov/vuln/detail/CVE-2026-33023"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-33021", "noindex": false, "published": "2026-04-14T21:57:22.817Z", "modified": "2026-04-16T13:54:36.177Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "severity": "high", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33021", "title": "libsixel: Use-after-free in sixel_encoder_encode_bytes()", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc", "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "https://nvd.nist.gov/vuln/detail/CVE-2026-33021"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-33020", "noindex": false, "published": "2026-04-14T21:53:00.388Z", "modified": "2026-04-15T13:30:47.463Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.00205, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33020", "title": "libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p", "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "https://nvd.nist.gov/vuln/detail/CVE-2026-33020"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-33019", "noindex": false, "published": "2026-04-14T21:49:25.204Z", "modified": "2026-04-15T20:02:46.628Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "severity": "high", "epss": 0.00256, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33019", "title": "libsixel: Integer overflow leads to Out-of-bounds Read in img2sixel", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds heap read in the --crop option handling of img2sixel, where positive coordinates up to INT_MAX are accepted without overflow-safe bounds checking. In sixel_encoder_do_clip(), the expression clip_w + clip_x overflows to a large negative value when clip_x is INT_MAX, causing the bounds guard to be skipped entirely, and the unclamped coordinate is passed through sixel_frame_clip() to clip(), which computes a source pointer far beyond the image buffer and passes it to memmove(). An attacke", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-c854-ffg9-g72c", "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "https://nvd.nist.gov/vuln/detail/CVE-2026-33019"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-33018", "noindex": false, "published": "2026-04-14T21:45:42.261Z", "modified": "2026-04-16T13:53:25.060Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00191, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33018", "title": "libsixel: Use-After-Free in load_gif()", "description": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a Use-After-Free vulnerability via the load_gif() function in fromgif.c, where a single sixel_frame_t object is reused across all frames of an animated GIF and gif_init_frame() unconditionally frees and reallocates frame->pixels between frames without consulting the object's reference count. Because the public API explicitly provides sixel_frame_ref() to retain a frame and sixel_frame_get_pixels() to access the raw pixel buffer, a callback following this documented usage pattern will hold a dangling pointer after the second frame is", "references": ["https://github.com/saitoha/libsixel/security/advisories/GHSA-w46f-jr9f-rgvp", "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "https://nvd.nist.gov/vuln/detail/CVE-2026-33018"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-61146", "noindex": false, "published": "2026-02-23T00:00:00.000Z", "modified": "2026-02-23T20:45:03.605Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00137, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-61146", "title": "CVE-2025-61146", "description": "saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.", "references": ["https://github.com/saitoha/libsixel/issues/207", "https://github.com/saitoha/libsixel/commit/e0ba6685262a3679cc5b9009c0c5b7dc8a3f262e", "https://gist.github.com/optionGo/1100e5be05c5558501a95f5e99160584"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-9300", "noindex": false, "published": "2025-08-21T13:02:08.108Z", "modified": "2025-08-21T14:46:37.782Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00256, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-9300", "title": "saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow", "description": "A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.", "references": ["https://vuldb.com/?id.320905", "https://vuldb.com/?ctiid.320905", "https://vuldb.com/?submit.632366"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-29978", "noindex": false, "published": "2022-05-11T13:12:05.000Z", "modified": "2024-08-03T06:40:47.700Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.01037, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-29978", "title": "CVE-2022-29978", "description": "There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.", "references": ["https://github.com/saitoha/libsixel/issues/166", "https://nvd.nist.gov/vuln/detail/CVE-2022-29978"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-29977", "noindex": false, "published": "2022-05-11T13:10:13.000Z", "modified": "2024-08-03T06:40:46.366Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.01037, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-29977", "title": "CVE-2022-29977", "description": "There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.", "references": ["https://github.com/saitoha/libsixel/issues/165", "https://nvd.nist.gov/vuln/detail/CVE-2022-29977"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-40656", "noindex": false, "published": "2022-04-08T15:09:33.000Z", "modified": "2024-08-04T02:51:06.400Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01019, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-40656", "title": "CVE-2021-40656", "description": "libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.", "references": ["https://github.com/libsixel/libsixel/issues/25", "https://nvd.nist.gov/vuln/detail/CVE-2021-40656"], "fixes": ["1.10.3-1"], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-27044", "noindex": false, "published": "2022-04-08T14:58:03.000Z", "modified": "2024-08-03T05:18:39.199Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01019, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-27044", "title": "CVE-2022-27044", "description": "libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876.", "references": ["https://github.com/saitoha/libsixel/issues/156", "https://nvd.nist.gov/vuln/detail/CVE-2022-27044"], "fixes": ["1.10.3-1"], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-41715", "noindex": false, "published": "2022-04-08T14:55:27.000Z", "modified": "2024-08-04T03:15:29.277Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01023, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-41715", "title": "CVE-2021-41715", "description": "libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379.", "references": ["https://github.com/libsixel/libsixel/issues/27", "https://nvd.nist.gov/vuln/detail/CVE-2021-41715"], "fixes": ["1.10.3-1"], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-27046", "noindex": false, "published": "2022-04-08T14:51:00.000Z", "modified": "2024-08-03T05:18:39.311Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01019, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-27046", "title": "CVE-2022-27046", "description": "libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.", "references": ["https://github.com/saitoha/libsixel/issues/157", "https://nvd.nist.gov/vuln/detail/CVE-2022-27046"], "fixes": ["1.10.3-1"], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-46700", "noindex": false, "published": "2022-02-19T18:22:19.000Z", "modified": "2024-08-04T05:17:41.584Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.00955, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-46700", "title": "CVE-2021-46700", "description": "In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.", "references": ["https://github.com/saitoha/libsixel/issues/158", "https://nvd.nist.gov/vuln/detail/CVE-2021-46700"], "fixes": [], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-45340", "noindex": false, "published": "2022-01-25T11:36:09.000Z", "modified": "2024-08-04T04:39:20.496Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.00918, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-45340", "title": "CVE-2021-45340", "description": "In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.", "references": ["https://github.com/libsixel/libsixel/issues/51", "https://nvd.nist.gov/vuln/detail/CVE-2021-45340"], "fixes": ["1.10.5-1"], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-21548", "noindex": false, "published": "2021-09-17T20:34:25.000Z", "modified": "2024-08-04T14:30:33.319Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01064, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-21548", "title": "CVE-2020-21548", "description": "Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.", "references": ["https://github.com/saitoha/libsixel/issues/116", "https://nvd.nist.gov/vuln/detail/CVE-2020-21548"], "fixes": ["1.8.6-1"], "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}]}], "total": 51, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "libsixel", "path": "vulns/debian-13/libsixel", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-20T01:04:11.699Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}