{"kind": "product", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "name": "kafka", "product": "kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS", "items": [{"id": "CVE-2026-114349", "noindex": false, "published": "2026-10-28T16:46:54.920Z", "modified": "2026-10-29T13:48:26.738Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00232, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114349", "title": "Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches", "description": "When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decomp", "references": ["https://kafka.apache.org/cve-list", "https://lists.apache.org/thread/hdy56hrd1h9btf30jb1noswsx32l17dq", "http://www.openwall.com/lists/oss-security/2026/10/28/18"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-112375", "noindex": false, "published": "2026-10-28T16:46:38.006Z", "modified": "2026-10-28T16:46:38.006Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00224, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112375", "title": "Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs", "description": "An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs (or AlterConfigs) request targeting a BROKER resource reaches the broker's configuration validation before any authorization check is applied to that path. Validation resolves configuration variables such as ${file:/path:key} or ${env:VAR} using a ConfigProvider named in the request, and this resolution bypasses the org.apache.kafka.automatic.config.providers allowlist that was added as the mitigation for CVE-2024-31141. An arbit", "references": ["https://kafka.apache.org/cve-list", "https://nvd.nist.gov/vuln/detail/CVE-2026-112375"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-115644", "noindex": false, "published": "2026-10-28T16:45:36.440Z", "modified": "2026-10-28T20:07:00.157Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00258, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115644", "title": "Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions", "description": "Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.\n\nWhen operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.\n\nWhile the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) f", "references": ["https://kafka.apache.org/cve-list", "http://www.openwall.com/lists/oss-security/2026/10/28/15", "https://nvd.nist.gov/vuln/detail/CVE-2026-115644"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-111551", "noindex": false, "published": "2026-10-28T16:45:25.163Z", "modified": "2026-10-28T20:06:57.172Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00222, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111551", "title": "Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation", "description": "Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext (header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length, which could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo group-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde", "references": ["https://kafka.apache.org/cve-list", "http://www.openwall.com/lists/oss-security/2026/10/28/13", "https://nvd.nist.gov/vuln/detail/CVE-2026-111551"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-111496", "noindex": false, "published": "2026-10-28T16:45:08.114Z", "modified": "2026-10-28T20:06:55.726Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00204, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111496", "title": "Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation", "description": "Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose ", "references": ["https://kafka.apache.org/cve-list", "http://www.openwall.com/lists/oss-security/2026/10/28/14", "https://nvd.nist.gov/vuln/detail/CVE-2026-111496"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-111073", "noindex": false, "published": "2026-10-28T16:37:58.482Z", "modified": "2026-10-28T20:06:51.327Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00204, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111073", "title": "Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service", "description": "The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the decompressed output size, growing a heap buffer until the compressed input is exhausted. A small, highly compressible payload (for example gzip-compressed zeros) can therefore expand to hundreds of megabytes of broker heap.\n\n\nImpact:\n\n\nAn authenticated client can send a PushTelemetry request with a small compressed payload that decompresses to a very large size, consuming broker heap o", "references": ["https://kafka.apache.org/cve-list", "http://www.openwall.com/lists/oss-security/2026/10/28/11", "https://nvd.nist.gov/vuln/detail/CVE-2026-111073"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-110985", "noindex": false, "published": "2026-10-28T16:37:45.688Z", "modified": "2026-10-28T16:37:45.688Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00126, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110985", "title": "Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured", "description": "A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and no verification key resolver is supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or error. This is the residual of CVE-2026-33557, whose fix restored signature verification only on the path where the JWKS endpoint URL is s", "references": ["https://kafka.apache.org/cve-list", "https://nvd.nist.gov/vuln/detail/CVE-2026-110985"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-110952", "noindex": false, "published": "2026-10-28T16:37:34.723Z", "modified": "2026-10-28T16:37:34.723Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00123, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110952", "title": "Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default", "description": "A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured:\n\n- The issuer (iss) claim is verified only when sasl.oauthbearer.expected.issuer is set. When it is unset, a validly-signed token carrying the expected audience is accepted regardless of which issuer minted it.\n- An audience (aud) claim is required only when sasl.oauthbearer.expected.audience is set. When it is unset, a validly-signed token that omits the aud claim is accepted. (A token that carries an aud claim is\n  still rejected when ", "references": ["https://kafka.apache.org/cve-list", "https://nvd.nist.gov/vuln/detail/CVE-2026-110952"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-83525", "noindex": false, "published": "2026-10-28T16:37:19.893Z", "modified": "2026-10-28T20:07:03.066Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-83525", "title": "Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.", "description": "Incorrect operator (CWE-480) in the FetchSnapshot RPC handler\nin Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2\non all platforms allows an authenticated attacker with\nCLUSTER_ACTION privilege to cause a denial of service\n(controller process termination) via a crafted\nFetchSnapshotRequest with an empty topics array or a topic\nwith no partitions.\n\nUsers are recommended to upgrade to version 4.2.2, 4.3.2, or\n4.4.0, which fix this issue. Users on unsupported branches\n(4.1.x and earlier) should upgrade to 4.2.2 or later.", "references": ["https://github.com/apache/kafka/pull/23185", "https://kafka.apache.org/cve-list", "http://www.openwall.com/lists/oss-security/2026/10/28/7"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-33557", "noindex": false, "published": "2026-04-20T13:28:43.669Z", "modified": "2026-07-15T01:06:14.162Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00897, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33557", "title": "Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication", "description": "A possible security vulnerability has been identified in Apache Kafka.\n\nBy default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.\n\nWe advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerabili", "references": ["https://kafka.apache.org/cve-list", "https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h", "http://www.openwall.com/lists/oss-security/2026/04/17/2"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-33558", "noindex": false, "published": "2026-04-20T13:20:38.059Z", "modified": "2026-04-20T14:20:41.640Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.0063, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33558", "title": "Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output", "description": "Information exposure vulnerability has been identified in Apache Kafka.\n\nThe NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are:\n\n\n  *  AlterConfigsRequest\n\n  *  AlterUserScramCredentialsRequest\n\n  *  ExpireDelegationTokenRequest\n\n  *  IncrementalAlterConfigsRequest\n\n  *  RenewDelegationTokenRequest\n\n  *  SaslAuthenticateRequest\n\n  *  createDelegationTokenResponse\n", "references": ["https://kafka.apache.org/cve-list", "https://lists.apache.org/thread/pz5g4ky3h0k91tfd14p0dzqjp80960kl", "http://www.openwall.com/lists/oss-security/2026/04/17/3"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2024-27309", "noindex": false, "published": "2024-04-12T06:58:45.134Z", "modified": "2025-07-30T03:55:45.408Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.01125, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-27309", "title": "Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode", "description": "While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\n\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\n\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\n\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affecte", "references": ["https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy", "http://www.openwall.com/lists/oss-security/2024/04/12/3", "https://security.netapp.com/advisory/ntap-20240705-0002/"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2021-38153", "noindex": false, "published": "2021-09-22T09:05:11.000Z", "modified": "2024-08-04T01:37:15.929Z", "cvss": 5.9, "cvss_vector": "", "severity": "medium", "epss": 0.06201, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-38153", "title": "Timing Attack Vulnerability for Apache Kafka Connect and Clients", "description": "Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.", "references": ["https://kafka.apache.org/cve-list", "https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E", "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E"], "fixes": [], "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}], "total": 13, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "kafka", "path": "vulns/ubuntu-pro-18.04-lts/kafka", "ecosystem": "Ubuntu:Pro:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 9, "kev": 0}, "lastmod": "2026-10-29T13:48:26.738Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}