{"kind": "product", "path": "vulns/ubuntu-18.04-lts/containerd", "name": "containerd", "product": "containerd", "ecosystem": "Ubuntu:18.04:LTS", "items": [{"id": "CVE-2022-23471", "noindex": false, "published": "2022-12-07T22:51:34.193Z", "modified": "2025-04-23T16:31:30.024Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.01109, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-23471", "title": "containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak", "description": "containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these ver", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9", "https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0", "https://security.gentoo.org/glsa/202401-31"], "fixes": ["1.5.9-0ubuntu1~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-31030", "noindex": false, "published": "2022-06-06T00:00:00.000Z", "modified": "2024-08-03T07:03:40.336Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00387, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-31030", "title": "containerd CRI plugin: Host memory exhaustion through ExecSync", "description": "containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve t", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf", "https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382", "http://www.openwall.com/lists/oss-security/2022/06/07/1"], "fixes": ["1.5.9-0ubuntu1~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-24778", "noindex": false, "published": "2022-03-25T17:20:11.000Z", "modified": "2025-04-22T18:17:56.011Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.02718, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-24778", "title": "Incorrect Authorization in imgcrypt", "description": "The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list w", "references": ["https://github.com/containerd/imgcrypt/security/advisories/GHSA-8v99-48m9-c8pm", "https://github.com/containerd/imgcrypt/issues/69", "https://github.com/containerd/imgcrypt/commit/6fdd9818a4d8142107b7ecd767d839c9707700d9"], "fixes": ["1.5.9-0ubuntu1~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-24769", "noindex": false, "published": "2022-03-24T00:00:00.000Z", "modified": "2024-08-03T04:20:49.949Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00492, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-24769", "title": "Default inheritable capabilities for linux container should be empty", "description": "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due t", "references": ["https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq", "https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f", "https://github.com/moby/moby/releases/tag/v20.10.14"], "fixes": ["1.5.9-0ubuntu1~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2022-23648", "noindex": false, "published": "2022-03-03T00:00:00.000Z", "modified": "2024-08-03T03:51:45.829Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.27392, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-23648", "title": "Insecure handling of image volumes in containerd CRI plugin", "description": "containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.1", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7", "https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70", "https://github.com/containerd/containerd/releases/tag/v1.4.13"], "fixes": ["1.5.5-0ubuntu3~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2021-43816", "noindex": false, "published": "2022-01-05T18:55:10.000Z", "modified": "2025-04-22T18:34:15.666Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.01682, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-43816", "title": "Improper Preservation of Permissions in containerd", "description": "containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permi", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c", "https://github.com/containerd/containerd/issues/6194", "https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea"], "fixes": ["1.5.9-0ubuntu1~18.04.1"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2021-41190", "noindex": false, "published": "2021-11-17T19:20:11.000Z", "modified": "2024-08-04T03:08:31.262Z", "cvss": 3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N", "severity": "low", "epss": 0.02223, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-41190", "title": "Clarify Content-Type handling in OCI spec", "description": "The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require tha", "references": ["https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m", "https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923", "http://www.openwall.com/lists/oss-security/2021/11/19/10"], "fixes": ["1.5.9-0ubuntu1~18.04.1"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2021-41103", "noindex": false, "published": "2021-10-04T00:00:00.000Z", "modified": "2024-08-04T02:59:31.538Z", "cvss": 5.9, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00518, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-41103", "title": "Insufficiently restricted permissions on plugin directories", "description": "containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could dis", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq", "https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"], "fixes": ["1.5.2-0ubuntu1~18.04.3"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2021-32760", "noindex": false, "published": "2021-07-19T00:00:00.000Z", "modified": "2024-11-19T14:27:20.905Z", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.01595, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-32760", "title": "Archive package allows chmod of file outside of unpack target directory", "description": "containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sourc", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w", "https://github.com/containerd/containerd/releases/tag/v1.4.8", "https://github.com/containerd/containerd/releases/tag/v1.5.4"], "fixes": ["1.5.2-0ubuntu1~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2021-21334", "noindex": false, "published": "2021-03-10T21:30:18.000Z", "modified": "2024-08-03T18:09:15.415Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.01947, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-21334", "title": "environment variable leak", "description": "In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If yo", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4", "https://github.com/containerd/containerd/releases/tag/v1.4.4", "https://github.com/containerd/containerd/releases/tag/v1.3.10"], "fixes": ["1.5.2-0ubuntu1~18.04.2"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2020-15257", "noindex": false, "published": "2020-12-01T02:30:16.000Z", "modified": "2024-08-04T13:15:19.030Z", "cvss": 5.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.03125, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2020-15257", "title": "containerd-shim API Exposed to Host Network Containers", "description": "containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed i", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4", "https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad", "https://github.com/containerd/containerd/releases/tag/v1.4.3"], "fixes": ["1.3.3-0ubuntu1~18.04.4"], "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}]}], "total": 11, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "containerd", "path": "vulns/ubuntu-18.04-lts/containerd", "ecosystem": "Ubuntu:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2025-04-23T16:31:30.024Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}