{"kind": "product", "path": "vulns/debian-14/evolution", "name": "evolution", "product": "evolution", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-88859", "noindex": false, "published": "2026-09-10T11:24:54.094Z", "modified": "2026-09-10T15:04:34.399Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00528, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88859", "title": "Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction", "description": "A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.", "references": ["https://access.redhat.com/security/cve/CVE-2026-88859", "https://bugzilla.redhat.com/show_bug.cgi?id=2531401", "https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388"], "fixes": [], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-3349", "noindex": false, "published": "2021-02-01T04:04:19.000Z", "modified": "2024-08-03T16:53:17.551Z", "cvss": 3.3, "cvss_vector": "", "severity": "low", "epss": 0.00346, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3349", "title": "CVE-2021-3349", "description": "GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior", "references": ["https://gitlab.gnome.org/GNOME/evolution/-/issues/299", "https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html", "https://dev.gnupg.org/T4735"], "fixes": [], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2020-11879", "noindex": false, "published": "2020-04-17T17:07:41.000Z", "modified": "2024-08-04T11:42:00.929Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.02761, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-11879", "title": "CVE-2020-11879", "description": "An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.", "references": ["https://gitlab.gnome.org/GNOME/evolution/issues/784", "https://gitlab.gnome.org/GNOME/evolution/-/blob/master/NEWS", "https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf"], "fixes": ["3.36.0-1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2013-4166", "noindex": false, "published": "2020-02-06T14:29:39.000Z", "modified": "2024-08-06T16:38:00.163Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.0189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-4166", "title": "CVE-2013-4166", "description": "The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.", "references": ["https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5", "https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627d", "http://seclists.org/oss-sec/2013/q3/191"], "fixes": [], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2018-15587", "noindex": false, "published": "2019-02-11T17:00:00.000Z", "modified": "2024-08-05T10:01:54.662Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.02443, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-15587", "title": "CVE-2018-15587", "description": "GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.", "references": ["https://bugzilla.gnome.org/show_bug.cgi?id=796424", "https://lists.debian.org/debian-lts-announce/2019/04/msg00027.html", "http://www.openwall.com/lists/oss-security/2019/04/30/4"], "fixes": ["3.30.5-1.1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2017-17689", "noindex": false, "published": "2018-05-16T19:00:00.000Z", "modified": "2024-08-05T20:59:17.441Z", "cvss": 5.9, "cvss_vector": "", "severity": "medium", "epss": 0.04144, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-17689", "title": "CVE-2017-17689", "description": "The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.", "references": ["https://news.ycombinator.com/item?id=17066419", "https://pastebin.com/gNCc8aYm", "http://www.securityfocus.com/bid/104165"], "fixes": [], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2011-3201", "noindex": false, "published": "2013-03-08T21:00:00.000Z", "modified": "2024-08-06T23:29:55.914Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.02673, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2011-3201", "title": "CVE-2011-3201", "description": "GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.", "references": ["https://git.gnome.org/browse/evolution/commit/?id=0a478083fa31aec0059bc6feacc054226fe55b56", "http://rhn.redhat.com/errata/RHSA-2013-0516.html", "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"], "fixes": [], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2009-1631", "noindex": false, "published": "2009-05-14T17:00:00.000Z", "modified": "2024-08-07T05:20:34.658Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2009-1631", "title": "CVE-2009-1631", "description": "The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.", "references": ["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409", "https://bugzilla.redhat.com/show_bug.cgi?id=498648", "http://bugzilla.gnome.org/show_bug.cgi?id=581604"], "fixes": ["2.29.90-1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2008-1109", "noindex": false, "published": "2008-06-04T20:00:00.000Z", "modified": "2024-08-07T08:08:57.396Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.05748, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2008-1109", "title": "CVE-2008-1109", "description": "Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).", "references": ["https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00179.html", "http://www.vupen.com/english/advisories/2008/1732/references", "http://secunia.com/advisories/30298"], "fixes": ["2.22.2-1.1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2008-1108", "noindex": false, "published": "2008-06-04T20:00:00.000Z", "modified": "2024-08-07T08:08:57.626Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.05694, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2008-1108", "title": "CVE-2008-1108", "description": "Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.", "references": ["https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00179.html", "http://www.vupen.com/english/advisories/2008/1732/references", "http://secunia.com/advisories/30298"], "fixes": ["2.22.2-1.1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2008-0072", "noindex": false, "published": "2008-03-06T00:00:00.000Z", "modified": "2024-08-07T07:32:23.892Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.06018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2008-0072", "title": "CVE-2008-0072", "description": "Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.", "references": ["http://secunia.com/advisories/29258", "http://secunia.com/advisories/29163", "http://www.debian.org/security/2008/dsa-1512"], "fixes": ["2.12.3-1.1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2007-3257", "noindex": false, "published": "2007-06-19T16:00:00.000Z", "modified": "2024-08-07T14:14:11.504Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.03122, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2007-3257", "title": "CVE-2007-3257", "description": "Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index.", "references": ["http://www.redhat.com/support/errata/RHSA-2007-0510.html", "http://secunia.com/advisories/25894", "http://www.securityfocus.com/archive/1/471455/100/0/threaded"], "fixes": ["2.12.0-1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2007-1002", "noindex": false, "published": "2007-03-21T22:00:00.000Z", "modified": "2024-08-07T12:43:22.417Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.03389, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2007-1002", "title": "CVE-2007-1002", "description": "Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.", "references": ["http://secunia.com/advisories/24651", "https://rhn.redhat.com/errata/RHSA-2007-0158.html", "http://www.securitytracker.com/id?1017808"], "fixes": ["2.10.2-1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2007-1266", "noindex": false, "published": "2007-03-06T20:00:00.000Z", "modified": "2024-08-07T12:50:35.039Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.05209, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2007-1266", "title": "CVE-2007-1266", "description": "Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.", "references": ["http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html", "http://securityreason.com/securityalert/2353", "http://www.securityfocus.com/archive/1/461958/30/7710/threaded"], "fixes": [], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2006-2789", "noindex": false, "published": "2006-06-02T22:00:00.000Z", "modified": "2024-08-07T18:06:25.943Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.02077, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2006-2789", "title": "CVE-2006-2789", "description": "Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when \"load images if sender in addressbook\" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted \"From\" header that triggers an assert error in camel-internet-address.c when a null pointer is used.", "references": ["http://www.mandriva.com/security/advisories?name=MDKSA-2006:094", "http://www.securityfocus.com/bid/18212", "http://bugzilla.gnome.org/show_bug.cgi?id=311440"], "fixes": ["2.4.0-1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2006-0040", "noindex": false, "published": "2006-03-10T01:00:00.000Z", "modified": "2024-08-07T16:18:20.633Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.01992, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2006-0040", "title": "CVE-2006-0040", "description": "GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml.", "references": ["http://www.vupen.com/english/advisories/2006/0801", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25050", "http://www.securityfocus.com/bid/16899"], "fixes": ["2.10.1"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2006-0528", "noindex": false, "published": "2006-02-02T11:00:00.000Z", "modified": "2024-08-07T16:41:27.664Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.11013, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2006-0528", "title": "CVE-2006-0528", "description": "The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains \"Content-Disposition: inline\" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.", "references": ["http://www.securityfocus.com/bid/16408", "https://usn.ubuntu.com/265-1/", "http://www.novell.com/linux/security/advisories/2006_07_sr.html"], "fixes": ["2.2.3-4"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2005-2550", "noindex": false, "published": "2005-08-12T04:00:00.000Z", "modified": "2024-08-07T22:30:01.117Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.04426, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2005-2550", "title": "CVE-2005-2550", "description": "Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.", "references": ["http://www.novell.com/linux/security/advisories/2005_54_evolution.html", "http://www.securityfocus.com/bid/14532", "http://www.redhat.com/support/errata/RHSA-2005-267.html"], "fixes": ["2.2.3-3"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2005-2549", "noindex": false, "published": "2005-08-12T04:00:00.000Z", "modified": "2024-08-07T22:30:01.619Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.04426, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2005-2549", "title": "CVE-2005-2549", "description": "Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.", "references": ["http://www.novell.com/linux/security/advisories/2005_54_evolution.html", "http://www.securityfocus.com/bid/14532", "http://www.redhat.com/support/errata/RHSA-2005-267.html"], "fixes": ["2.2.3-3"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}, {"id": "CVE-2002-1765", "noindex": false, "published": "2005-06-21T04:00:00.000Z", "modified": "2024-08-08T03:34:56.323Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.01634, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2002-1765", "title": "CVE-2002-1765", "description": "Evolution 1.0.3 and 1.0.4 allows remote attackers to cause a denial of service (memory consumption and crash) via an email with a malformed MIME header.", "references": ["http://online.securityfocus.com/advisories/4117", "http://mail.gnome.org/archives/gnome-announce-list/2002-May/msg00020.html", "https://exchange.xforce.ibmcloud.com/vulnerabilities/9059"], "fixes": ["1.0.5"], "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}]}], "total": 28, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "evolution", "path": "vulns/debian-14/evolution", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T15:04:34.399Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}