{"kind": "product", "path": "vulns/debian-13/nova", "name": "nova", "product": "nova", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-46448", "noindex": false, "published": "2026-06-16T00:00:00.000Z", "modified": "2026-06-17T12:17:30.606Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00457, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46448", "title": "CVE-2026-46448", "description": "In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.", "references": ["https://bugs.launchpad.net/nova/+bug/2151252", "https://www.openwall.com/lists/oss-security/2026/06/16/5", "http://www.openwall.com/lists/oss-security/2026/06/16/5"], "fixes": [], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "DSA-6145-1", "noindex": false, "published": "2026-02-19T00:00:00Z", "modified": "2026-02-19T21:30:35.157650Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/dsa-6145-1", "title": "nova - security update", "description": "nova - security update", "references": ["https://osv.dev/vulnerability/DSA-6145-1"], "fixes": ["2:31.0.0-6+deb13u2"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-24708", "noindex": false, "published": "2026-02-18T00:00:00.000Z", "modified": "2026-09-11T12:09:05.112Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H", "severity": "high", "epss": 0.00416, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-24708", "title": "CVE-2026-24708", "description": "An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.", "references": ["https://bugs.launchpad.net/nova/+bug/2137507", "https://www.openwall.com/lists/oss-security/2026/02/17/7", "https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html"], "fixes": ["2:31.0.0-6+deb13u2"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2024-32498", "noindex": false, "published": "2024-07-05T00:00:00.000Z", "modified": "2025-11-04T16:12:13.552Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00835, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-32498", "title": "CVE-2024-32498", "description": "An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.", "references": ["https://launchpad.net/bugs/2059809", "http://www.openwall.com/lists/oss-security/2024/07/02/2", "https://www.openwall.com/lists/oss-security/2024/07/02/2"], "fixes": ["2:29.0.2-4"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2023-2088", "noindex": false, "published": "2023-05-12T00:00:00.000Z", "modified": "2025-11-04T16:09:57.798Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.01198, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-2088", "title": "CVE-2023-2088", "description": "A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.", "references": ["https://security.openstack.org/ossa/OSSA-2023-003.html", "https://bugs.launchpad.net/bugs/2004555", "https://lists.debian.org/debian-lts-announce/2024/09/msg00015.html"], "fixes": ["2:26.1.0-4"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-47951", "noindex": false, "published": "2023-01-26T00:00:00.000Z", "modified": "2025-03-31T16:49:31.493Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.01034, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-47951", "title": "CVE-2022-47951", "description": "An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.", "references": ["https://launchpad.net/bugs/1996188", "https://security.openstack.org/ossa/OSSA-2023-002.html", "https://lists.debian.org/debian-lts-announce/2023/01/msg00040.html"], "fixes": ["2:26.0.0-6"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-37394", "noindex": false, "published": "2022-08-03T06:43:44.000Z", "modified": "2024-08-03T10:29:20.965Z", "cvss": 3.3, "cvss_vector": "", "severity": "low", "epss": 0.00309, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-37394", "title": "CVE-2022-37394", "description": "An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.", "references": ["https://bugs.launchpad.net/ossa/+bug/1981813", "https://review.opendev.org/c/openstack/nova/+/849985", "https://review.opendev.org/c/openstack/nova/+/850003"], "fixes": ["2:26.0.0~rc1-3"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2021-3654", "noindex": false, "published": "2022-03-02T00:00:00.000Z", "modified": "2024-08-03T17:01:07.959Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.26792, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3654", "title": "CVE-2021-3654", "description": "A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.", "references": ["https://security.openstack.org/ossa/OSSA-2021-002.html", "https://bugs.launchpad.net/nova/+bug/1927677", "https://www.openwall.com/lists/oss-security/2021/07/29/2"], "fixes": ["2:23.0.2-3"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-17376", "noindex": false, "published": "2020-08-26T18:45:28.000Z", "modified": "2024-08-04T13:53:16.983Z", "cvss": 8.3, "cvss_vector": "", "severity": "high", "epss": 0.01729, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-17376", "title": "CVE-2020-17376", "description": "An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.", "references": ["https://launchpad.net/bugs/1890501", "https://security.openstack.org/ossa/OSSA-2020-006.html", "http://www.openwall.com/lists/oss-security/2020/08/25/4"], "fixes": ["2:21.1.0-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2015-9543", "noindex": false, "published": "2020-02-19T02:11:06.000Z", "modified": "2024-08-06T08:51:05.311Z", "cvss": 3.3, "cvss_vector": "", "severity": "low", "epss": 0.00411, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2015-9543", "title": "CVE-2015-9543", "description": "An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py.", "references": ["https://launchpad.net/bugs/1492140", "https://review.opendev.org/220622", "https://security.openstack.org/ossa/OSSA-2020-001.html"], "fixes": ["2:20.1.1-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2013-0326", "noindex": false, "published": "2019-12-05T16:09:36.000Z", "modified": "2024-08-06T14:25:09.127Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-0326", "title": "CVE-2013-0326", "description": "OpenStack nova base images permissions are world readable", "references": ["https://security-tracker.debian.org/tracker/CVE-2013-0326", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0326", "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-0326"], "fixes": [], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2011-4076", "noindex": false, "published": "2019-11-26T03:53:58.000Z", "modified": "2024-08-06T23:53:32.881Z", "cvss": 5.9, "cvss_vector": "", "severity": "medium", "epss": 0.01458, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2011-4076", "title": "CVE-2011-4076", "description": "OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.", "references": ["https://security-tracker.debian.org/tracker/CVE-2011-4076", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4076", "https://access.redhat.com/security/cve/cve-2011-4076"], "fixes": ["2012.1~e1-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2019-14433", "noindex": false, "published": "2019-08-09T18:21:04.000Z", "modified": "2024-08-05T00:19:41.228Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.01943, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-14433", "title": "CVE-2019-14433", "description": "An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.", "references": ["https://launchpad.net/bugs/1837877", "https://security.openstack.org/ossa/OSSA-2019-003.html", "http://www.openwall.com/lists/oss-security/2019/08/06/6"], "fixes": ["2:19.0.2-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2011-3147", "noindex": false, "published": "2019-04-22T15:35:58.896Z", "modified": "2024-09-16T18:38:54.968Z", "cvss": 2.8, "cvss_vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "severity": "low", "epss": 0.0074, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2011-3147", "title": "qcow format could expose host filesystem information", "description": "Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.", "references": ["http://bazaar.launchpad.net/~hudson-openstack/nova/trunk/revision/1604", "https://nvd.nist.gov/vuln/detail/CVE-2011-3147"], "fixes": ["2012.1~e1-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2017-18191", "noindex": false, "published": "2018-02-19T17:00:00.000Z", "modified": "2024-08-05T21:13:49.181Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.03715, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-18191", "title": "CVE-2017-18191", "description": "An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.", "references": ["http://www.securityfocus.com/bid/103104", "https://access.redhat.com/errata/RHSA-2018:2714", "https://review.openstack.org/539893"], "fixes": ["2:17.0.0-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2017-17051", "noindex": false, "published": "2017-12-05T18:00:00.000Z", "modified": "2024-08-05T20:43:59.804Z", "cvss": 8.6, "cvss_vector": "", "severity": "high", "epss": 0.01989, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-17051", "title": "CVE-2017-17051", "description": "An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.", "references": ["https://review.openstack.org/521662", "https://security.openstack.org/ossa/OSSA-2017-006.html", "https://review.openstack.org/523214"], "fixes": ["2:16.0.3-6"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2017-16239", "noindex": false, "published": "2017-11-14T17:00:00.000Z", "modified": "2024-08-05T20:20:05.208Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.01421, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-16239", "title": "CVE-2017-16239", "description": "In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.", "references": ["http://www.securityfocus.com/bid/101950", "https://access.redhat.com/errata/RHSA-2018:0369", "https://access.redhat.com/errata/RHSA-2018:0241"], "fixes": ["2:16.0.3-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2015-2687", "noindex": false, "published": "2017-08-09T18:00:00.000Z", "modified": "2024-08-06T05:24:38.281Z", "cvss": 4.7, "cvss_vector": "", "severity": "medium", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2015-2687", "title": "CVE-2015-2687", "description": "OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.", "references": ["http://www.openwall.com/lists/oss-security/2015/03/24/10", "https://review.openstack.org/#/c/338929/", "http://www.securityfocus.com/bid/77505"], "fixes": ["2014.1-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2017-7214", "noindex": false, "published": "2017-03-21T18:00:00.000Z", "modified": "2024-08-05T15:56:35.974Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02302, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-7214", "title": "CVE-2017-7214", "description": "An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.", "references": ["https://access.redhat.com/errata/RHSA-2017:1595", "http://www.securityfocus.com/bid/96998", "https://launchpad.net/bugs/1673569"], "fixes": ["2:14.0.0-4"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}, {"id": "CVE-2015-5162", "noindex": false, "published": "2016-10-07T14:00:00.000Z", "modified": "2024-08-06T06:41:07.567Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.03088, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2015-5162", "title": "CVE-2015-5162", "description": "The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.", "references": ["https://launchpad.net/bugs/1449062", "http://www.securityfocus.com/bid/76849", "http://rhn.redhat.com/errata/RHSA-2017-0153.html"], "fixes": ["2:13.0.0-1"], "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}]}], "total": 64, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nova", "path": "vulns/debian-13/nova", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-11T12:09:05.112Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}