{"kind": "product", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "name": "civicrm", "product": "civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS", "items": [{"id": "CVE-2026-72558", "noindex": false, "published": "2026-08-11T11:12:15.097Z", "modified": "2026-08-11T12:23:07.453Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-72558", "title": "CiviCRM CiviCRM - SQL Injection", "description": "An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.", "references": ["https://github.com/civicrm/civicrm-core", "https://nvd.nist.gov/vuln/detail/CVE-2026-72558"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2025-65187", "noindex": false, "published": "2025-12-02T00:00:00.000Z", "modified": "2025-12-02T19:30:37.641Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00224, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-65187", "title": "CVE-2025-65187", "description": "A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.", "references": ["https://civicrm.com/", "https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65187.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2025-65187"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2025-3573", "noindex": false, "published": "2025-04-15T05:00:09.474Z", "modified": "2025-04-15T15:03:53.661Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00359, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-3573", "title": "CVE-2025-3573", "description": "Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.", "references": ["https://security.snyk.io/vuln/SNYK-JS-JQUERYVALIDATION-5952285", "https://github.com/jquery-validation/jquery-validation/pull/2462", "https://github.com/jquery-validation/jquery-validation/commit/7a490d8f39bd988027568ddcf51755e1f4688902"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2023-25440", "noindex": false, "published": "2023-05-23T00:00:00.000Z", "modified": "2025-01-31T13:49:50.574Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.02537, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-25440", "title": "CVE-2023-25440", "description": "Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.", "references": ["https://civicrm.org/", "https://packetstormsecurity.com/files/172470/CiviCRM-5.59.alpha1-Cross-Site-Scripting.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-25440"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2023-28447", "noindex": false, "published": "2023-03-28T20:07:39.103Z", "modified": "2025-11-03T21:47:36.097Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "severity": "high", "epss": 0.01016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28447", "title": "Cross site scripting vulnerability in Javascript escaping in smarty/smarty", "description": "Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.", "references": ["https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj", "https://github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713d", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/"], "fixes": ["4.7.30+dfsg-1ubuntu1+esm1"], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2023-28115", "noindex": false, "published": "2023-03-17T21:15:25.113Z", "modified": "2025-02-25T14:53:10.142Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.0276, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28115", "title": "Snappy vulnerable to PHAR deserialization, allowing remote code execution", "description": "Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromH", "references": ["https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc", "https://github.com/KnpLabs/snappy/pull/469", "https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2022-2400", "noindex": false, "published": "2022-07-18T00:00:00.000Z", "modified": "2024-08-03T00:39:06.372Z", "cvss": 5.3, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.01209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-2400", "title": "External Control of File Name or Path in dompdf/dompdf", "description": "External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.", "references": ["https://huntr.dev/bounties/a6da5e5e-86be-499a-a3c3-2950f749202a", "https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a", "https://lists.debian.org/debian-lts-announce/2023/07/msg00017.html"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2022-31147", "noindex": false, "published": "2022-07-14T19:30:14.000Z", "modified": "2025-04-23T18:02:09.780Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0224, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-31147", "title": "jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306", "description": "The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.", "references": ["https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-ffmh-x56j-9rc3", "https://github.com/jquery-validation/jquery-validation/commit/5bbd80d27fc6b607d2f7f106c89522051a9fb0dd", "https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2022-31091", "noindex": false, "published": "2022-06-27T00:00:00.000Z", "modified": "2025-04-23T18:08:21.161Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.01565, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-31091", "title": "Change in port should be considered a change in origin in Guzzle", "description": "Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host", "references": ["https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82", "https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699", "https://www.debian.org/security/2022/dsa-5246"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2022-31090", "noindex": false, "published": "2022-06-27T00:00:00.000Z", "modified": "2025-04-23T18:08:33.825Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.01916, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-31090", "title": "CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle", "description": "Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Gu", "references": ["https://github.com/guzzle/guzzle/security/advisories/GHSA-25mq-v84q-4j7r", "https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82", "https://www.debian.org/security/2022/dsa-5246"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2021-43306", "noindex": false, "published": "2022-06-01T16:47:27.576Z", "modified": "2024-09-16T23:56:26.165Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.01523, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-43306", "title": "Exponential ReDoS in jquery-validation", "description": "An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method", "references": ["https://research.jfrog.com/vulnerabilities/jquery-validation-redos-xray-211348/", "https://nvd.nist.gov/vuln/detail/CVE-2021-43306"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2020-36389", "noindex": false, "published": "2021-06-17T00:00:00.000Z", "modified": "2024-08-04T17:23:10.489Z", "cvss": 4.3, "cvss_vector": "", "severity": "medium", "epss": 0.00661, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-36389", "title": "CVE-2020-36389", "description": "In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.", "references": ["https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-form", "https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/", "https://nvd.nist.gov/vuln/detail/CVE-2020-36389"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2020-36388", "noindex": false, "published": "2021-06-17T00:00:00.000Z", "modified": "2024-08-04T17:23:10.444Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01438, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-36388", "title": "CVE-2020-36388", "description": "In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.", "references": ["https://civicrm.org/advisory/civi-sa-2020-03", "https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/", "https://nvd.nist.gov/vuln/detail/CVE-2020-36388"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2021-21252", "noindex": false, "published": "2021-01-13T00:00:00.000Z", "modified": "2024-08-03T18:09:14.663Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.03575, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-21252", "title": "Regular expression denial of service in jquery-validation", "description": "The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.", "references": ["https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm", "https://github.com/jquery-validation/jquery-validation/pull/2371", "https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2018-1999022", "noindex": false, "published": "2018-07-23T16:00:00.000Z", "modified": "2024-09-16T16:38:06.455Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-1999022", "title": "CVE-2018-1999022", "description": "PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears t", "references": ["https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform", "http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/", "https://nvd.nist.gov/vuln/detail/CVE-2018-1999022"], "fixes": [], "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}], "total": 15, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "civicrm", "path": "vulns/ubuntu-pro-18.04-lts/civicrm", "ecosystem": "Ubuntu:Pro:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-11T12:23:07.453Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}