{"kind": "version", "path": "vulns/packagist/shopware%2Fcore/6.7.6.1", "name": "shopware/core", "product": "shopware/core", "ecosystem": "Packagist", "version": "6.7.6.1", "items": [{"id": "CVE-2026-48012", "noindex": false, "published": "2026-07-23T19:16:38.956Z", "modified": "2026-07-24T13:31:43.099Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48012", "title": "Shopware SSO referer trust leading to an arbitrary redirect target", "description": "Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination ", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-4x3x-869w-xx3m", "https://github.com/shopware/shopware/releases/tag/v6.7.10.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-48012"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48013", "noindex": false, "published": "2026-07-23T19:14:32.579Z", "modified": "2026-07-23T19:27:54.530Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00366, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48013", "title": "Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel `uploadFromURL` flow validates target IPs against private/reserved ranges via `FileUrlValidator`, the `linkURL` flow only performs a URL format check (regex for `http://` or `https://` prefix), allowing SSRF to internal network services and cloud metadata endpoints. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gq96-5pfx-f4vc", "https://github.com/shopware/shopware/releases/tag/v6.6.10.18", "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48009", "noindex": false, "published": "2026-07-17T17:58:15.568Z", "modified": "2026-07-17T19:08:02.871Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00457, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48009", "title": "Shopware: Admin Account Takeover via User Recovery Hash Exposure", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/user-recovery/password; the root cause is that src/Core/System/User/Recovery/UserRecoveryDefinition.php exposes the hash field through the Admin API without ApiAware(false) or ReadProtection. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-8v9p-g828-v98f", "https://github.com/shopware/shopware/commit/06f8b9aa4fecb239a2ff33a6546192d7ce7ed0f8", "https://github.com/shopware/shopware/commit/9ef4873f810e26fb38da051624f7f2720139279a"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48014", "noindex": false, "published": "2026-07-17T17:56:43.236Z", "modified": "2026-07-21T01:48:04.992Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48014", "title": "Shopware: Admin API ACL Bypass in Order State Transition Endpoints", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege check, so AclAnnotationValidator exits when route ACL metadata is absent and low-privileged users without order:update, order_transaction:update, or order_delivery:update can trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-f8q6-3g5w-jjr6", "https://github.com/shopware/shopware/commit/86dff24ba500e16325742e59d20357f57a79c2af", "https://github.com/shopware/shopware/commit/9f15faee704b61e8a96657024fa96c70b47ad082"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48010", "noindex": false, "published": "2026-07-17T17:55:25.722Z", "modified": "2026-07-17T23:15:41.762Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00472, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48010", "title": "Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7", "https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d", "https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48016", "noindex": false, "published": "2026-07-17T17:54:21.990Z", "modified": "2026-07-20T19:27:17.356Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00414, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48016", "title": "Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-9v5m-39wh-5chq", "https://github.com/shopware/shopware/commit/69dd5b6cb01d3c2aea49ac29dd4512a87836ac3f", "https://github.com/shopware/shopware/commit/df15f2e607dcf9ebc4a26ec622ffcf452dc25090"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48015", "noindex": false, "published": "2026-07-17T17:53:01.695Z", "modified": "2026-07-17T18:11:57.809Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00485, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48015", "title": "Shopware: Stored XSS via SVG file upload — no SVG sanitization", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc", "https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497", "https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48008", "noindex": false, "published": "2026-07-17T17:47:27.906Z", "modified": "2026-07-17T19:47:56.823Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00472, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48008", "title": "Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gv8p-48fr-4fxg", "https://github.com/shopware/shopware/commit/1e047f6d7fd9129271e28c1c9f1c272983c6f48f", "https://github.com/shopware/shopware/commit/db5adff33ec30b648979cd1938c87f164f7b3073"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48011", "noindex": false, "published": "2026-06-10T20:07:02.345Z", "modified": "2026-06-11T14:26:36.286Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48011", "title": "Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames", "description": "Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw", "https://github.com/shopware/shopware/releases/tag/v6.6.10.18", "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31889", "noindex": false, "published": "2026-03-11T18:56:23.171Z", "modified": "2026-03-12T20:04:11.623Z", "cvss": 8.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "severity": "high", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31889", "title": "Shopware has a potential take over of app credentials", "description": "Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registrati", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-c4p7-rwrg-pf6p", "https://nvd.nist.gov/vuln/detail/CVE-2026-31889"], "fixes": ["6.7.8.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31888", "noindex": false, "published": "2026-03-11T18:53:03.018Z", "modified": "2026-03-12T20:02:47.581Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00231, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31888", "title": "Shopware has user enumeration via distinct error codes on Store API login endpoint", "description": "Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_NOT_FOUND). The \"not found\" response also echoes the probed email address. This allows an unauthenticated attacker to enumerate valid customer accounts. The storefront login controller correctly unifies both error paths, but the Store API does not — indicating an inconsistent defense. This vulnerability is fixed in 6.7.8.1 and 6", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gqc5-xv7m-gcjq", "https://nvd.nist.gov/vuln/detail/CVE-2026-31888"], "fixes": ["6.7.8.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31887", "noindex": false, "published": "2026-03-11T18:49:46.294Z", "modified": "2026-03-12T20:02:14.866Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31887", "title": "Shopware unauthenticated data extraction possible through store-api.order endpoint", "description": "Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-7vvp-j573-5584", "https://nvd.nist.gov/vuln/detail/CVE-2026-31887"], "fixes": ["6.7.8.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}], "total": 12, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["6.7.8.1", "6.7.6.1", "6.7.4.1", "6.7.3.1", "6.7.2.1", "6.7.0.0-rc2", "6.7.0.0-rc1", "6.6.5.1", "6.6.1.0", "6.5.8.18", "6.5.8.17", "6.5.8.13"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-24T13:31:43.099Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}