{"kind": "product", "path": "vulns/ubuntu-14.04-lts/php5", "name": "php5", "product": "php5", "ecosystem": "Ubuntu:14.04:LTS", "items": [{"id": "CVE-2019-9675", "noindex": false, "published": "2019-03-11T07:00:00.000Z", "modified": "2024-08-04T21:54:45.246Z", "cvss": 8.1, "cvss_vector": "", "severity": "high", "epss": 0.06021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9675", "title": "CVE-2019-9675", "description": "An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: \"This issue allows theoretical compromise of security, but a practical attack is usually impossible.", "references": ["http://php.net/ChangeLog-7.php", "https://bugs.php.net/bug.php?id=77586", "https://usn.ubuntu.com/3922-2/"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9641", "noindex": false, "published": "2019-03-08T23:00:00.000Z", "modified": "2024-08-04T21:54:45.449Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.09395, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9641", "title": "CVE-2019-9641", "description": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.", "references": ["https://www.debian.org/security/2019/dsa-4403", "https://bugs.php.net/bug.php?id=77509", "https://usn.ubuntu.com/3922-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9640", "noindex": false, "published": "2019-03-08T23:00:00.000Z", "modified": "2024-08-04T21:54:45.054Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.06183, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9640", "title": "CVE-2019-9640", "description": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.", "references": ["https://www.debian.org/security/2019/dsa-4403", "https://bugs.php.net/bug.php?id=77540", "https://usn.ubuntu.com/3922-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9639", "noindex": false, "published": "2019-03-08T23:00:00.000Z", "modified": "2024-08-04T21:54:45.448Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.08202, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9639", "title": "CVE-2019-9639", "description": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.", "references": ["https://www.debian.org/security/2019/dsa-4403", "https://bugs.php.net/bug.php?id=77659", "https://usn.ubuntu.com/3922-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9638", "noindex": false, "published": "2019-03-08T23:00:00.000Z", "modified": "2024-08-04T21:54:45.455Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.06677, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9638", "title": "CVE-2019-9638", "description": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.", "references": ["https://www.debian.org/security/2019/dsa-4403", "https://bugs.php.net/bug.php?id=77563", "https://usn.ubuntu.com/3922-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9637", "noindex": false, "published": "2019-03-08T23:00:00.000Z", "modified": "2024-08-04T21:54:45.245Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.07347, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9637", "title": "CVE-2019-9637", "description": "An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.", "references": ["https://www.debian.org/security/2019/dsa-4403", "https://bugs.php.net/bug.php?id=77630", "https://usn.ubuntu.com/3922-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9024", "noindex": false, "published": "2019-02-22T23:00:00.000Z", "modified": "2024-08-04T21:38:45.149Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.0712, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9024", "title": "CVE-2019-9024", "description": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.", "references": ["https://usn.ubuntu.com/3902-2/", "https://www.debian.org/security/2019/dsa-4398", "https://usn.ubuntu.com/3902-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.27"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9023", "noindex": false, "published": "2019-02-22T23:00:00.000Z", "modified": "2024-08-04T21:38:45.186Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.09317, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9023", "title": "CVE-2019-9023", "description": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.", "references": ["https://usn.ubuntu.com/3902-2/", "https://bugs.php.net/bug.php?id=77382", "https://bugs.php.net/bug.php?id=77418"], "fixes": ["5.5.9+dfsg-1ubuntu4.27"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9022", "noindex": false, "published": "2019-02-22T23:00:00.000Z", "modified": "2024-08-04T21:31:37.646Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.04188, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9022", "title": "CVE-2019-9022", "description": "An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.", "references": ["https://www.debian.org/security/2019/dsa-4398", "https://usn.ubuntu.com/3902-1/", "https://bugs.php.net/bug.php?id=77369"], "fixes": ["5.5.9+dfsg-1ubuntu4.29"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9021", "noindex": false, "published": "2019-02-22T23:00:00.000Z", "modified": "2024-08-04T21:31:37.497Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.10059, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9021", "title": "CVE-2019-9021", "description": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.", "references": ["https://usn.ubuntu.com/3902-2/", "https://www.debian.org/security/2019/dsa-4398", "https://usn.ubuntu.com/3902-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.27"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2019-9020", "noindex": false, "published": "2019-02-22T23:00:00.000Z", "modified": "2024-08-04T21:31:37.504Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.10059, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9020", "title": "CVE-2019-9020", "description": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.", "references": ["https://bugs.php.net/bug.php?id=77249", "https://usn.ubuntu.com/3902-2/", "https://www.debian.org/security/2019/dsa-4398"], "fixes": ["5.5.9+dfsg-1ubuntu4.27"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-17082", "noindex": false, "published": "2018-09-16T15:00:00.000Z", "modified": "2024-08-05T10:39:59.550Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.04103, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-17082", "title": "CVE-2018-17082", "description": "The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a \"Transfer-Encoding: chunked\" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.", "references": ["http://php.net/ChangeLog-5.php", "http://php.net/ChangeLog-7.php", "https://www.debian.org/security/2018/dsa-4353"], "fixes": ["5.5.9+dfsg-1ubuntu4.26"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-14883", "noindex": false, "published": "2018-08-03T13:00:00.000Z", "modified": "2024-08-05T09:46:23.773Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.08863, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-14883", "title": "CVE-2018-14883", "description": "An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.", "references": ["http://www.securityfocus.com/bid/104871", "https://security.netapp.com/advisory/ntap-20181107-0003/", "https://usn.ubuntu.com/3766-1/"], "fixes": ["5.5.9+dfsg-1ubuntu4.26"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-14851", "noindex": false, "published": "2018-08-02T19:00:00.000Z", "modified": "2024-08-05T09:38:14.062Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.04252, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-14851", "title": "CVE-2018-14851", "description": "exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.", "references": ["http://www.securityfocus.com/bid/104871", "http://php.net/ChangeLog-5.php", "https://security.netapp.com/advisory/ntap-20181107-0003/"], "fixes": ["5.5.9+dfsg-1ubuntu4.26"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-10548", "noindex": false, "published": "2018-04-29T21:00:00.000Z", "modified": "2024-08-05T07:39:08.017Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.08349, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10548", "title": "CVE-2018-10548", "description": "An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.", "references": ["http://www.securityfocus.com/bid/104019", "http://www.securitytracker.com/id/1040807", "https://usn.ubuntu.com/3646-2/"], "fixes": ["5.5.9+dfsg-1ubuntu4.25"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-10547", "noindex": false, "published": "2018-04-29T21:00:00.000Z", "modified": "2024-08-05T07:39:08.524Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.03435, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10547", "title": "CVE-2018-10547", "description": "An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.", "references": ["http://www.securitytracker.com/id/1040807", "https://usn.ubuntu.com/3646-2/", "https://bugs.php.net/bug.php?id=76129"], "fixes": ["5.5.9+dfsg-1ubuntu4.25"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-10546", "noindex": false, "published": "2018-04-29T21:00:00.000Z", "modified": "2024-08-05T07:39:08.370Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.09775, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10546", "title": "CVE-2018-10546", "description": "An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.", "references": ["http://www.securityfocus.com/bid/104019", "http://www.securitytracker.com/id/1040807", "https://bugs.php.net/bug.php?id=76249"], "fixes": ["5.5.9+dfsg-1ubuntu4.25"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-10545", "noindex": false, "published": "2018-04-29T21:00:00.000Z", "modified": "2024-08-05T07:39:08.069Z", "cvss": 4.7, "cvss_vector": "", "severity": "medium", "epss": 0.00786, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10545", "title": "CVE-2018-10545", "description": "An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.", "references": ["https://bugs.php.net/bug.php?id=75605", "https://usn.ubuntu.com/3646-2/", "http://www.securityfocus.com/bid/104022"], "fixes": ["5.5.9+dfsg-1ubuntu4.25"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-7584", "noindex": false, "published": "2018-03-01T18:00:00.000Z", "modified": "2024-08-05T06:31:04.995Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.87348, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-7584", "title": "CVE-2018-7584", "description": "In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.", "references": ["https://usn.ubuntu.com/3600-1/", "https://www.debian.org/security/2018/dsa-4240", "https://bugs.php.net/bug.php?id=75981"], "fixes": ["5.5.9+dfsg-1ubuntu4.24"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2016-10712", "noindex": false, "published": "2018-02-09T06:00:00.000Z", "modified": "2024-08-06T03:30:20.196Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02254, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-10712", "title": "CVE-2016-10712", "description": "In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a \"$uri = stream_get_meta_data(fopen($file, \"r\"))['uri']\" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker.", "references": ["https://usn.ubuntu.com/3600-1/", "https://bugs.php.net/bug.php?id=71323", "https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=6297a117d77fa3a0df2e21ca926a92c231819cd5"], "fixes": ["5.5.9+dfsg-1ubuntu4.24"], "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}]}], "total": 177, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 9, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "php5", "path": "vulns/ubuntu-14.04-lts/php5", "ecosystem": "Ubuntu:14.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2024-08-06T03:30:20.196Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}