{"kind": "product", "path": "vulns/debian-14/python-cryptography", "name": "python-cryptography", "product": "python-cryptography", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-69249", "noindex": false, "published": "2026-08-03T21:26:45.826Z", "modified": "2026-09-04T21:20:32.666Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00252, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-69249", "title": "python-cryptography: Duplicate self-signed intermediates can cause exponential path-building", "description": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource ex", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "https://github.com/pyca/cryptography/pull/14960", "https://github.com/pyca/cryptography/commit/3763aa79b"], "fixes": ["49.0.0-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-69248", "noindex": false, "published": "2026-08-03T21:21:43.710Z", "modified": "2026-09-02T13:26:35.057Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00244, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-69248", "title": "python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid ce", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "https://github.com/pyca/cryptography/pull/14888", "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2"], "fixes": ["49.0.0-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-69247", "noindex": false, "published": "2026-08-03T21:16:32.047Z", "modified": "2026-08-04T14:09:24.615Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-69247", "title": "cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an ", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5", "https://github.com/pyca/cryptography/pull/15369", "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"], "fixes": ["49.0.0-2"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-39892", "noindex": false, "published": "2026-04-08T20:49:41.967Z", "modified": "2026-09-10T12:04:47.954Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00757, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-39892", "title": "cryptography has a buffer overflow if non-contiguous buffers were passed to APIs", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq", "http://www.openwall.com/lists/oss-security/2026/04/08/12", "https://access.redhat.com/security/cve/CVE-2026-39892"], "fixes": ["46.0.7-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-34073", "noindex": false, "published": "2026-03-31T02:04:36.275Z", "modified": "2026-10-14T16:07:55.097Z", "cvss": 1.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00184, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34073", "title": "cryptography has incomplete DNS name constraint enforcement on peer names", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43", "https://www.kb.cert.org/vuls/id/948176", "https://nvd.nist.gov/vuln/detail/CVE-2026-34073"], "fixes": ["46.0.6-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-26007", "noindex": false, "published": "2026-02-10T21:42:56.471Z", "modified": "2026-09-16T12:04:21.492Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-26007", "title": "cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the vi", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2", "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c", "http://www.openwall.com/lists/oss-security/2026/02/10/4"], "fixes": ["46.0.5-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-26130", "noindex": false, "published": "2024-02-21T16:28:18.632Z", "modified": "2024-08-14T20:01:52.628Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00831, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-26130", "title": "cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4", "https://github.com/pyca/cryptography/pull/10423", "https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55"], "fixes": ["42.0.5-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-50782", "noindex": false, "published": "2024-02-05T20:45:49.705Z", "modified": "2026-03-24T11:28:21.353Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.01118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-50782", "title": "Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659", "description": "A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.", "references": ["https://access.redhat.com/security/cve/CVE-2023-50782", "https://bugzilla.redhat.com/show_bug.cgi?id=2254432", "https://www.couchbase.com/alerts/"], "fixes": ["42.0.5-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-49083", "noindex": false, "published": "2023-11-29T18:50:24.263Z", "modified": "2025-12-18T15:32:14.214Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00985, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-49083", "title": "cryptography vulnerable to NULL-dereference when loading PKCS7 certificates", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97", "https://github.com/pyca/cryptography/pull/9926", "https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a"], "fixes": ["41.0.7-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-23931", "noindex": false, "published": "2023-02-07T20:54:03.628Z", "modified": "2025-11-03T21:47:19.856Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.01301, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-23931", "title": "Cipher.update_into can corrupt memory in pyca cryptography", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r", "https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3", "https://security.netapp.com/advisory/ntap-20230324-0007/"], "fixes": ["38.0.4-3"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2020-36242", "noindex": false, "published": "2021-02-07T19:50:57.000Z", "modified": "2024-08-04T17:23:09.814Z", "cvss": 9.1, "cvss_vector": "", "severity": "critical", "epss": 0.06718, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-36242", "title": "CVE-2020-36242", "description": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.", "references": ["https://github.com/pyca/cryptography/issues/5615", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/", "https://www.oracle.com/security-alerts/cpuapr2022.html"], "fixes": ["3.3.2-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2020-25659", "noindex": false, "published": "2021-01-11T15:37:29.000Z", "modified": "2024-08-04T15:40:36.578Z", "cvss": 5.9, "cvss_vector": "", "severity": "medium", "epss": 0.02463, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-25659", "title": "CVE-2020-25659", "description": "python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.", "references": ["https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.oracle.com/security-alerts/cpujul2022.html"], "fixes": ["3.2.1-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2018-10903", "noindex": false, "published": "2018-07-30T15:00:00.000Z", "modified": "2024-08-05T07:54:36.330Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.03196, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10903", "title": "CVE-2018-10903", "description": "A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.", "references": ["https://access.redhat.com/errata/RHSA-2018:3600", "https://usn.ubuntu.com/3720-1/", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903"], "fixes": ["2.3-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}, {"id": "CVE-2016-9243", "noindex": false, "published": "2017-03-27T17:00:00.000Z", "modified": "2024-08-06T02:42:11.253Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.03464, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-9243", "title": "CVE-2016-9243", "description": "HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U23KDR2M2N7W2ZSREG63BVW7D4VC6CIZ/", "http://www.ubuntu.com/usn/USN-3138-1", "https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874"], "fixes": ["1.5.3-1"], "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "python-cryptography", "path": "vulns/debian-14/python-cryptography", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-14T16:07:55.097Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}