{"kind": "product", "path": "vulns/ubuntu-16.04-lts/grafana", "name": "grafana", "product": "grafana", "ecosystem": "Ubuntu:16.04:LTS", "items": [{"id": "CVE-2026-33374", "noindex": false, "published": "2026-10-13T17:05:49.782Z", "modified": "2026-10-13T19:21:25.512Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00368, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33374", "title": "Unbounded memory allocation in the Prometheus rule conversion API", "description": "The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33374", "https://nvd.nist.gov/vuln/detail/CVE-2026-33374"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-19197", "noindex": false, "published": "2026-08-26T08:50:27.854Z", "modified": "2026-08-27T17:22:36.904Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-19197", "title": "Broken access control in dashboard snapshots", "description": "A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).", "references": ["https://grafana.com/security/security-advisories/cve-2026-19197", "https://nvd.nist.gov/vuln/detail/CVE-2026-19197"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-17183", "noindex": false, "published": "2026-08-19T17:30:06.798Z", "modified": "2026-08-27T17:22:31.524Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-17183", "title": "CVE-2026-17183 CVE Record", "description": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.", "references": ["https://grafana.com/security/security-advisories/cve-2026-17183", "https://nvd.nist.gov/vuln/detail/CVE-2026-17183"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-11817", "noindex": false, "published": "2026-08-17T21:28:17.497Z", "modified": "2026-09-14T10:16:35.588Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-11817", "title": "CVE-2026-11817 CVE Record", "description": "This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a ", "references": ["https://grafana.com/security/security-advisories/cve-2026-11817", "https://nvd.nist.gov/vuln/detail/CVE-2026-11817"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-42127", "noindex": false, "published": "2026-06-22T16:31:28.096Z", "modified": "2026-08-27T17:22:36.246Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-42127", "title": "Pre-authentication denial of service in the public dashboard query endpoint", "description": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.", "references": ["https://grafana.com/security/security-advisories/cve-2026-42127", "https://nvd.nist.gov/vuln/detail/CVE-2026-42127"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-9029", "noindex": false, "published": "2026-06-22T13:18:40.770Z", "modified": "2026-08-27T17:22:27.685Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00251, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-9029", "title": "Stored XSS in the Geomap panel tile-layer attribution", "description": "A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).", "references": ["https://grafana.com/security/security-advisories/cve-2026-9029", "https://nvd.nist.gov/vuln/detail/CVE-2026-9029"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-28374", "noindex": false, "published": "2026-05-13T19:28:40.053Z", "modified": "2026-08-27T17:22:38.240Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-28374", "title": "IDOR in Annotations API allows unprivileged users to DELETE annotation", "description": "Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.", "references": ["https://grafana.com/security/security-advisories/cve-2026-28374", "https://nvd.nist.gov/vuln/detail/CVE-2026-28374"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-33378", "noindex": false, "published": "2026-05-13T19:28:37.606Z", "modified": "2026-08-27T17:22:48.777Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00328, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33378", "title": "Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro", "description": "Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33378", "https://nvd.nist.gov/vuln/detail/CVE-2026-33378"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-28383", "noindex": false, "published": "2026-05-13T19:28:36.952Z", "modified": "2026-08-27T17:22:21.832Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00328, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-28383", "title": "Grafana plugin resources can lead to unbounded memory allocation", "description": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.", "references": ["https://grafana.com/security/security-advisories/cve-2026-28383", "https://nvd.nist.gov/vuln/detail/CVE-2026-28383"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-33376", "noindex": false, "published": "2026-05-13T19:28:34.473Z", "modified": "2026-08-27T17:22:50.919Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00282, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33376", "title": "Auth Proxy IPv6 whitelist bypass", "description": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33376", "https://nvd.nist.gov/vuln/detail/CVE-2026-33376"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-33380", "noindex": false, "published": "2026-05-13T19:28:32.915Z", "modified": "2026-08-27T17:22:19.705Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00366, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33380", "title": "SQL Expressions Read File From Disk", "description": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33380", "https://nvd.nist.gov/vuln/detail/CVE-2026-33380"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-28380", "noindex": false, "published": "2026-05-13T19:28:32.257Z", "modified": "2026-08-27T17:22:39.589Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-28380", "title": "BAC in Snapshot API allows deletion of unauthorized dashboard snapshots", "description": "Any Editor could delete any snapshot, even if they have no access to read or write them.", "references": ["https://grafana.com/security/security-advisories/cve-2026-28380", "https://nvd.nist.gov/vuln/detail/CVE-2026-28380"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-33381", "noindex": false, "published": "2026-05-13T19:28:31.559Z", "modified": "2026-08-27T17:22:46.706Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00343, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33381", "title": "Users can generate Service Account tokens after permissions removal", "description": "When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33381", "https://nvd.nist.gov/vuln/detail/CVE-2026-33381"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-33377", "noindex": false, "published": "2026-05-13T19:28:28.154Z", "modified": "2026-08-27T17:22:32.185Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00226, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33377", "title": "Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin", "description": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33377", "https://nvd.nist.gov/vuln/detail/CVE-2026-33377"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-28376", "noindex": false, "published": "2026-05-13T19:28:26.544Z", "modified": "2026-08-27T17:22:45.329Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00328, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-28376", "title": "Grafana Live push endpoint allows unbounded memory allocation leading to OOM", "description": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.", "references": ["https://grafana.com/security/security-advisories/cve-2026-28376", "https://nvd.nist.gov/vuln/detail/CVE-2026-28376"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-28379", "noindex": false, "published": "2026-05-13T19:28:25.836Z", "modified": "2026-08-27T17:22:26.322Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00262, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-28379", "title": "Viewer-triggered race condition in Grafana Live leads to complete server crash", "description": "A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.", "references": ["https://grafana.com/security/security-advisories/cve-2026-28379", "https://nvd.nist.gov/vuln/detail/CVE-2026-28379"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-21727", "noindex": false, "published": "2026-04-15T18:57:25.185Z", "modified": "2026-08-27T17:22:44.594Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00204, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-21727", "title": "Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record", "description": "A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.", "references": ["https://grafana.com/security/security-advisories/cve-2026-21727", "https://nvd.nist.gov/vuln/detail/CVE-2026-21727"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2025-12141", "noindex": false, "published": "2026-04-15T14:59:41.317Z", "modified": "2026-04-15T18:45:53.672Z", "cvss": 1.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y", "severity": "low", "epss": 0.00255, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2025-12141", "title": "Grafana Alerting Editors can edit destination of webhooks they did not create", "description": "In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.", "references": ["https://grafana.com/security/security-advisories/cve-2025-12141/", "https://nvd.nist.gov/vuln/detail/CVE-2025-12141"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-27879", "noindex": false, "published": "2026-03-27T14:28:56.133Z", "modified": "2026-08-27T17:22:24.918Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.0039, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-27879", "title": "Query resampling can cause unbounded memory allocations", "description": "A resample query can be used to trigger out-of-memory crashes in Grafana.", "references": ["https://grafana.com/security/security-advisories/cve-2026-27879", "https://nvd.nist.gov/vuln/detail/CVE-2026-27879"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-28375", "noindex": false, "published": "2026-03-27T14:26:19.270Z", "modified": "2026-08-27T17:22:22.927Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.0039, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-28375", "title": "Grafana Testdata datasource can issue unbounded memory allocations", "description": "A testdata data-source can be used to trigger out-of-memory crashes in Grafana.", "references": ["https://grafana.com/security/security-advisories/cve-2026-28375", "https://nvd.nist.gov/vuln/detail/CVE-2026-28375"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}], "total": 95, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 5, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-13T19:21:25.512Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}