{"kind": "product", "path": "vulns/nextcloud", "name": "nextcloud", "product": "nextcloud", "items": [{"id": "CVE-2026-77165", "noindex": false, "published": "2026-09-21T15:25:33.553Z", "modified": "2026-09-21T18:44:22.324Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00415, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-77165", "title": "CVE-2026-77165", "description": "File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.", "references": ["https://hackerone.com/reports/3770482", "https://nvd.nist.gov/vuln/detail/CVE-2026-77165"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2026-68493", "noindex": false, "published": "2026-09-18T01:26:04.654Z", "modified": "2026-09-18T19:40:16.781Z", "cvss": 3.1, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-68493", "title": "CVE-2026-68493", "description": "After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.", "references": ["https://hackerone.com/reports/3484601", "https://nvd.nist.gov/vuln/detail/CVE-2026-68493"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2026-82985", "noindex": false, "published": "2026-09-18T01:26:04.650Z", "modified": "2026-09-18T19:40:43.484Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00377, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-82985", "title": "CVE-2026-82985", "description": "The Photos app's filter-based \"smart albums\" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album.\n\nThis requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files withou", "references": ["https://hackerone.com/reports/3506873", "https://nvd.nist.gov/vuln/detail/CVE-2026-82985"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2026-77164", "noindex": false, "published": "2026-09-18T01:26:04.650Z", "modified": "2026-09-18T19:41:07.400Z", "cvss": 6.2, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-77164", "title": "CVE-2026-77164", "description": "Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address.\n\nThe response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot ", "references": ["https://hackerone.com/reports/3303283", "https://nvd.nist.gov/vuln/detail/CVE-2026-77164"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2018-3762", "noindex": false, "published": "2018-07-05T16:00:00.000Z", "modified": "2024-08-05T04:50:30.641Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00888, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2018-3762", "title": "CVE-2018-3762", "description": "Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2018-002", "https://hackerone.com/reports/358339", "https://nvd.nist.gov/vuln/detail/CVE-2018-3762"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2018-3761", "noindex": false, "published": "2018-07-05T16:00:00.000Z", "modified": "2024-08-05T04:50:30.619Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.01657, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2018-3761", "title": "CVE-2018-3761", "description": "Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.", "references": ["https://hackerone.com/reports/343111", "https://nextcloud.com/security/advisory/?id=nc-sa-2018-003", "https://nvd.nist.gov/vuln/detail/CVE-2018-3761"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0936", "noindex": false, "published": "2018-03-28T20:00:00.000Z", "modified": "2024-09-16T21:58:27.852Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00752, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0936", "title": "CVE-2017-0936", "description": "Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.", "references": ["https://hackerone.com/reports/297751", "https://nextcloud.com/security/advisory/?id=nc-sa-2018-001", "https://nvd.nist.gov/vuln/detail/CVE-2017-0936"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0895", "noindex": false, "published": "2017-05-08T20:00:00.000Z", "modified": "2024-08-05T13:25:17.074Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00724, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0895", "title": "CVE-2017-0895", "description": "Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.", "references": ["https://hackerone.com/reports/203594", "https://nextcloud.com/security/advisory/?id=nc-sa-2017-012", "https://nvd.nist.gov/vuln/detail/CVE-2017-0895"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0894", "noindex": false, "published": "2017-05-08T20:00:00.000Z", "modified": "2024-08-05T13:18:06.452Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.01169, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0894", "title": "CVE-2017-0894", "description": "Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-011", "https://hackerone.com/reports/218876", "https://nvd.nist.gov/vuln/detail/CVE-2017-0894"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0893", "noindex": false, "published": "2017-05-08T20:00:00.000Z", "modified": "2024-08-05T13:18:06.510Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00643, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0893", "title": "CVE-2017-0893", "description": "Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-010", "https://hackerone.com/reports/222838", "https://nvd.nist.gov/vuln/detail/CVE-2017-0893"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0892", "noindex": false, "published": "2017-05-08T20:00:00.000Z", "modified": "2024-08-05T13:18:06.453Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00985, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0892", "title": "CVE-2017-0892", "description": "Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.", "references": ["https://hackerone.com/reports/191979", "https://nextcloud.com/security/advisory/?id=nc-sa-2017-009", "https://nvd.nist.gov/vuln/detail/CVE-2017-0892"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0891", "noindex": false, "published": "2017-05-08T20:00:00.000Z", "modified": "2024-08-05T13:18:06.396Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00643, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0891", "title": "CVE-2017-0891", "description": "Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-008", "https://hackerone.com/reports/216812", "https://nvd.nist.gov/vuln/detail/CVE-2017-0891"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0890", "noindex": false, "published": "2017-05-08T20:00:00.000Z", "modified": "2024-08-05T13:18:06.510Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00739, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0890", "title": "CVE-2017-0890", "description": "Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.", "references": ["https://hackerone.com/reports/213227", "https://nextcloud.com/security/advisory/?id=nc-sa-2017-007", "https://nvd.nist.gov/vuln/detail/CVE-2017-0890"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0888", "noindex": false, "published": "2017-04-05T20:00:00.000Z", "modified": "2024-08-05T13:18:06.471Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.01537, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0888", "title": "CVE-2017-0888", "description": "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the \"files\" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information.", "references": ["https://hackerone.com/reports/179073", "https://nextcloud.com/security/advisory/?id=nc-sa-2017-006", "http://www.securityfocus.com/bid/97491"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0887", "noindex": false, "published": "2017-04-05T20:00:00.000Z", "modified": "2024-08-05T13:18:06.509Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00888, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0887", "title": "CVE-2017-0887", "description": "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-005", "https://hackerone.com/reports/173622", "https://nvd.nist.gov/vuln/detail/CVE-2017-0887"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0886", "noindex": false, "published": "2017-04-05T20:00:00.000Z", "modified": "2024-08-05T13:18:06.533Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0123, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0886", "title": "CVE-2017-0886", "description": "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-004", "https://hackerone.com/reports/174524", "https://nvd.nist.gov/vuln/detail/CVE-2017-0886"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0885", "noindex": false, "published": "2017-04-05T20:00:00.000Z", "modified": "2024-08-05T13:18:06.507Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00899, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0885", "title": "CVE-2017-0885", "description": "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-003", "https://hackerone.com/reports/174524", "https://nvd.nist.gov/vuln/detail/CVE-2017-0885"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0884", "noindex": false, "published": "2017-04-05T20:00:00.000Z", "modified": "2024-08-05T13:18:06.462Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00666, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0884", "title": "CVE-2017-0884", "description": "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-002", "https://hackerone.com/reports/169680", "https://nvd.nist.gov/vuln/detail/CVE-2017-0884"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}, {"id": "CVE-2017-0883", "noindex": false, "published": "2017-04-05T20:00:00.000Z", "modified": "2024-08-05T13:18:06.386Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00593, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2017-0883", "title": "CVE-2017-0883", "description": "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. Note that this only affects folders and files that the adversary has at least read-only permissions for.", "references": ["https://nextcloud.com/security/advisory/?id=nc-sa-2017-001", "https://hackerone.com/reports/169680", "https://nvd.nist.gov/vuln/detail/CVE-2017-0883"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}], "total": 19, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["32.0.0", "31.0.0"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-21T18:44:22.324Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}