{"kind": "version", "path": "vulns/packagist/craftcms%2Fcms/5.10", "name": "craftcms/cms", "product": "craftcms/cms", "ecosystem": "Packagist", "version": "5.10", "items": [{"id": "CVE-2026-72787", "noindex": false, "published": "2026-08-12T19:07:36.918Z", "modified": "2026-10-08T15:24:30.510Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00261, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72787", "title": "Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name", "description": "Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-2rp4-x2j7-qmcc", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-stored-xss-via-draft-name", "https://nvd.nist.gov/vuln/detail/CVE-2026-72787"], "fixes": ["5.10.8"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72786", "noindex": false, "published": "2026-08-12T19:07:35.873Z", "modified": "2026-10-08T15:24:29.916Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00462, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72786", "title": "Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset", "description": "Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-p8x7-9vfw-p7vc", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-authentication-bypass-via-password-reset", "https://nvd.nist.gov/vuln/detail/CVE-2026-72786"], "fixes": ["5.10.8"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72785", "noindex": false, "published": "2026-08-11T12:17:19.183Z", "modified": "2026-10-08T15:24:29.323Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00267, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72785", "title": "Craft CMS before 5.10.6 Authorization Bypass via structures/move-element", "description": "Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its ", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-xxpx-f366-4xpq", "https://www.vulncheck.com/advisories/craft-cms-before-authorization-bypass-via-structures-move-element", "https://nvd.nist.gov/vuln/detail/CVE-2026-72785"], "fixes": ["5.10.6"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72783", "noindex": false, "published": "2026-08-11T12:17:17.772Z", "modified": "2026-10-08T15:24:28.767Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72783", "title": "Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained", "description": "Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-7hxc-f267-h5q7", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-path-traversal-via-ensurepathiscontained", "https://nvd.nist.gov/vuln/detail/CVE-2026-72783"], "fixes": ["5.10.6"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72782", "noindex": false, "published": "2026-08-11T12:17:17.101Z", "modified": "2026-10-08T15:24:28.239Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00386, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72782", "title": "Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak", "description": "Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-596p-6jv8-775v", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-environment-variable-leak", "https://nvd.nist.gov/vuln/detail/CVE-2026-72782"], "fixes": ["5.10.6"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72781", "noindex": false, "published": "2026-08-11T12:17:16.358Z", "modified": "2026-10-08T15:24:27.730Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00786, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72781", "title": "Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape", "description": "Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\\base\\Component up to yii\\base\\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\\base\\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-f5wm-88jv-g5hx", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-remote-code-execution-via-twig-sandbox-escape", "https://nvd.nist.gov/vuln/detail/CVE-2026-72781"], "fixes": ["5.10.7"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72780", "noindex": false, "published": "2026-08-11T12:17:15.532Z", "modified": "2026-10-08T15:24:27.206Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00385, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72780", "title": "Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey", "description": "Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-wg23-69c2-gjc8", "https://www.vulncheck.com/advisories/craft-cms-before-webauthn-assertion-replay-via-login-with-passkey", "https://nvd.nist.gov/vuln/detail/CVE-2026-72780"], "fixes": ["5.10.5"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72779", "noindex": false, "published": "2026-08-11T12:17:14.804Z", "modified": "2026-10-08T15:24:26.374Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00376, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72779", "title": "Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject", "description": "Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfileobject", "https://nvd.nist.gov/vuln/detail/CVE-2026-72779"], "fixes": ["5.10.6"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-72778", "noindex": false, "published": "2026-08-11T12:17:14.099Z", "modified": "2026-10-08T15:24:25.832Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00803, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-72778", "title": "Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config", "description": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as be", "references": ["https://github.com/craftcms/cms/security/advisories/GHSA-265m-7826-wjqm", "https://www.vulncheck.com/advisories/craft-cms-rc1-before-authenticated-rce-via-condition-config", "https://nvd.nist.gov/vuln/detail/CVE-2026-72778"], "fixes": ["5.10.6"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-14794", "noindex": false, "published": "2026-07-06T03:45:09.182Z", "modified": "2026-07-06T13:05:23.079Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X", "severity": "medium", "epss": 0.00385, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-14794", "title": "Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization", "description": "A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.", "references": ["https://vuldb.com/vuln/376388", "https://vuldb.com/vuln/376388/cti", "https://vuldb.com/cve/CVE-2026-14794"], "fixes": ["5.10.3"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-14793", "noindex": false, "published": "2026-07-06T03:30:10.238Z", "modified": "2026-07-06T16:49:07.984Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X", "severity": "medium", "epss": 0.00386, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-14793", "title": "Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization", "description": "A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. Upgrading to version 4.18.1 is able to address this issue. The patch is identified as 9bd05c91e6a7e6da5e949ec41a31c220c059aa04. The affected component should be upgraded.", "references": ["https://vuldb.com/vuln/376387", "https://vuldb.com/vuln/376387/cti", "https://vuldb.com/cve/CVE-2026-14793"], "fixes": ["5.10.3"], "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}]}], "total": 11, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "craftcms/cms", "path": "vulns/packagist/craftcms%2Fcms", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["5.10.7", "5.10.6", "5.10.5", "5.10.4.1", "5.10.4", "5.10.3", "5.10.2", "5.10.1", "5.10.0", "5.10", "5.9.53", "5.9.23"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:24:30.510Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}