{"kind": "product", "path": "vulns/debian-14/rlottie", "name": "rlottie", "product": "rlottie", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-108978", "noindex": false, "published": "2026-10-11T21:31:24.126Z", "modified": "2026-10-16T15:54:16.765Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-108978", "title": "CVE-2026-108978", "description": "Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.\n\nThis issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.", "references": ["https://github.com/Samsung/rlottie/pull/609/", "https://nvd.nist.gov/vuln/detail/CVE-2026-108978"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-91826", "noindex": false, "published": "2026-09-15T08:49:48.401Z", "modified": "2026-09-15T13:32:31.821Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00144, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-91826", "title": "CVE-2026-91826", "description": "Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations.\n\n\nThis issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39.", "references": ["https://github.com/Samsung/rlottie/pull/607", "https://nvd.nist.gov/vuln/detail/CVE-2026-91826"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-82797", "noindex": false, "published": "2026-08-31T11:28:08.147Z", "modified": "2026-08-31T14:27:19.437Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-82797", "title": "CVE-2026-82797", "description": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\n\nThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.", "references": ["https://github.com/Samsung/rlottie/pull/603", "https://nvd.nist.gov/vuln/detail/CVE-2026-82797"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-19588", "noindex": false, "published": "2026-08-12T02:23:07.478Z", "modified": "2026-08-12T13:33:37.037Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00353, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19588", "title": "CVE-2026-19588", "description": "Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.", "references": ["https://github.com/Samsung/rlottie/pull/600", "https://nvd.nist.gov/vuln/detail/CVE-2026-19588"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-19587", "noindex": false, "published": "2026-08-12T02:14:59.193Z", "modified": "2026-08-12T12:37:05.429Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00355, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19587", "title": "CVE-2026-19587", "description": "Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.", "references": ["https://github.com/Samsung/rlottie/pull/599", "https://nvd.nist.gov/vuln/detail/CVE-2026-19587"], "fixes": ["0.1+dfsg-4"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-19518", "noindex": false, "published": "2026-08-11T06:27:06.343Z", "modified": "2026-08-12T00:29:17.567Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00355, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19518", "title": "CVE-2026-19518", "description": "Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.", "references": ["https://github.com/Samsung/rlottie/pull/596", "https://nvd.nist.gov/vuln/detail/CVE-2026-19518"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-19517", "noindex": false, "published": "2026-08-11T06:23:22.926Z", "modified": "2026-08-12T00:23:21.935Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00355, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19517", "title": "CVE-2026-19517", "description": "Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.", "references": ["https://github.com/Samsung/rlottie/pull/596", "https://nvd.nist.gov/vuln/detail/CVE-2026-19517"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-18772", "noindex": false, "published": "2026-08-04T08:22:48.165Z", "modified": "2026-08-12T00:22:22.068Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00355, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18772", "title": "CVE-2026-18772", "description": "Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.", "references": ["https://github.com/Samsung/rlottie/pull/596", "https://nvd.nist.gov/vuln/detail/CVE-2026-18772"], "fixes": ["0.1+dfsg-4"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-15551", "noindex": false, "published": "2026-07-13T00:11:59.190Z", "modified": "2026-07-13T15:46:29.647Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H", "severity": "medium", "epss": 0.0011, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-15551", "title": "Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size", "description": "Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\n\nThis issue affects .", "references": ["https://github.com/Samsung/rlottie/pull/595", "https://nvd.nist.gov/vuln/detail/CVE-2026-15551"], "fixes": [], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-8916", "noindex": false, "published": "2026-06-04T09:44:26.603Z", "modified": "2026-06-08T23:17:11.160Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00103, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-8916", "title": "CVE-2026-8916", "description": "Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\n\nThis issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.", "references": ["https://github.com/Samsung/rlottie/pull/589", "https://nvd.nist.gov/vuln/detail/CVE-2026-8916"], "fixes": ["0.1+dfsg-3"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-47318", "noindex": false, "published": "2026-06-04T09:43:56.316Z", "modified": "2026-06-08T08:09:44.846Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00105, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47318", "title": "CVE-2026-47318", "description": "Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\n\nThis issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.", "references": ["https://github.com/Samsung/rlottie/pull/582", "https://nvd.nist.gov/vuln/detail/CVE-2026-47318"], "fixes": ["0.1+dfsg-3"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-47306", "noindex": false, "published": "2026-06-04T09:43:14.593Z", "modified": "2026-06-08T00:31:38.938Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00103, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47306", "title": "CVE-2026-47306", "description": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.", "references": ["https://github.com/Samsung/rlottie/pull/585", "https://nvd.nist.gov/vuln/detail/CVE-2026-47306"], "fixes": ["0.1+dfsg-3"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-49510", "noindex": false, "published": "2026-06-04T09:41:17.647Z", "modified": "2026-06-08T00:30:49.807Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00104, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-49510", "title": "CVE-2026-49510", "description": "Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.\n\nThis issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.", "references": ["https://github.com/Samsung/rlottie/pull/592", "https://nvd.nist.gov/vuln/detail/CVE-2026-49510"], "fixes": ["0.1+dfsg-1"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-10305", "noindex": false, "published": "2026-06-04T09:40:26.586Z", "modified": "2026-06-07T23:19:43.751Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00103, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-10305", "title": "CVE-2026-10305", "description": "Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.\n\nThis issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.", "references": ["https://github.com/Samsung/rlottie/pull/587", "https://nvd.nist.gov/vuln/detail/CVE-2026-10305"], "fixes": ["0.1+dfsg-5"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-47319", "noindex": false, "published": "2026-06-04T09:39:55.058Z", "modified": "2026-06-08T05:31:02.960Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00103, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47319", "title": "CVE-2026-47319", "description": "Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.\n\nThis issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.", "references": ["https://github.com/Samsung/rlottie/pull/588", "https://nvd.nist.gov/vuln/detail/CVE-2026-47319"], "fixes": ["0.1+dfsg-5"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-47320", "noindex": false, "published": "2026-06-04T09:38:27.208Z", "modified": "2026-06-07T23:35:51.061Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00104, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47320", "title": "CVE-2026-47320", "description": "Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.", "references": ["https://github.com/Samsung/rlottie/pull/593", "https://nvd.nist.gov/vuln/detail/CVE-2026-47320"], "fixes": ["0.1+dfsg-5"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-53074", "noindex": false, "published": "2025-06-30T01:48:54.197Z", "modified": "2025-06-30T13:31:56.701Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00391, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-53074", "title": "CVE-2025-53074", "description": "Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2.", "references": ["https://github.com/Samsung/rlottie/pull/571", "https://nvd.nist.gov/vuln/detail/CVE-2025-53074"], "fixes": ["0.1+dfsg-4.3"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-53075", "noindex": false, "published": "2025-06-30T01:47:05.766Z", "modified": "2025-06-30T13:53:37.611Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00283, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-53075", "title": "CVE-2025-53075", "description": "Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.", "references": ["https://github.com/Samsung/rlottie/pull/571", "https://nvd.nist.gov/vuln/detail/CVE-2025-53075"], "fixes": ["0.1+dfsg-4.3"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-0634", "noindex": false, "published": "2025-06-30T01:44:57.595Z", "modified": "2026-01-22T18:06:37.778Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0051, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-0634", "title": "CVE-2025-0634", "description": "Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.", "references": ["https://github.com/Samsung/rlottie/pull/571", "https://github.com/Samsung/rlottie/commit/507ea027e47d3e1dc7ddbd9994621215eae7ebb9", "https://nvd.nist.gov/vuln/detail/CVE-2025-0634"], "fixes": ["0.1+dfsg-4.3"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-31317", "noindex": false, "published": "2021-05-18T19:44:46.000Z", "modified": "2024-08-03T22:55:53.469Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.01288, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-31317", "title": "CVE-2021-31317", "description": "Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.", "references": ["https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/", "https://www.shielder.it/advisories/telegram-rlottie-vdasher-vdasher-type-confusion/", "https://nvd.nist.gov/vuln/detail/CVE-2021-31317"], "fixes": ["0.1+dfsg-2"], "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}]}], "total": 21, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "rlottie", "path": "vulns/debian-14/rlottie", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-16T15:54:16.765Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}