{"kind": "product", "path": "vulns/pypi/copyparty", "name": "copyparty", "product": "copyparty", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-104102", "noindex": false, "published": "2026-10-12T18:32:00.821Z", "modified": "2026-10-13T16:31:17.851Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N", "severity": "medium", "epss": 0.00313, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-104102", "title": "copyparty FTP: upload outside defined volumes (limited path traversal)", "description": "copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-phv8-wgjp-g4p9", "https://github.com/9001/copyparty/commit/b331bb1c8c8cc306b91e4d94221969335a7a3e86", "https://github.com/9001/copyparty/releases/tag/v1.20.19"], "fixes": ["1.20.19"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70657", "noindex": false, "published": "2026-08-18T14:59:54.218Z", "modified": "2026-08-19T16:19:51.186Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00331, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70657", "title": "Copyparty: file/dirkey confusion", "description": "Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-x5pq-m9p8-f4vx", "https://github.com/9001/copyparty/commit/e40755331ba9449993ff482456e6bdd2c6deb950", "https://github.com/9001/copyparty/releases/tag/v1.20.17"], "fixes": ["1.20.17"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-32109", "noindex": false, "published": "2026-03-11T20:16:34.480Z", "modified": "2026-03-12T19:45:30.412Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-32109", "title": "Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`", "description": "Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; \"https://example.com/foo/.prologue.html\". The vulnerability is that \"https://example.com/foo/?b\" would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes i", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-rcp6-88mm-9vgf", "https://nvd.nist.gov/vuln/detail/CVE-2026-32109"], "fixes": ["1.20.12"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-32108", "noindex": false, "published": "2026-03-11T20:14:18.998Z", "modified": "2026-03-12T19:47:10.628Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-32108", "title": "Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access", "description": "Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner;", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm", "https://nvd.nist.gov/vuln/detail/CVE-2026-32108"], "fixes": ["1.20.12"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-30974", "noindex": false, "published": "2026-03-10T17:37:26.214Z", "modified": "2026-03-11T14:45:33.773Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00335, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-30974", "title": "Copyparty volflag `nohtml` did not block javascript in svg files", "description": "Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm", "https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5", "https://github.com/9001/copyparty/releases/tag/v1.20.11"], "fixes": ["1.20.11"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27948", "noindex": false, "published": "2026-02-26T01:32:15.184Z", "modified": "2026-02-26T15:07:56.702Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00196, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27948", "title": "Copyparty vulnerable to eflected cross-site scripting via setck parameter", "description": "Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h", "https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc", "https://nvd.nist.gov/vuln/detail/CVE-2026-27948"], "fixes": ["1.20.9"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-58753", "noindex": false, "published": "2025-09-09T19:54:36.056Z", "modified": "2025-09-10T20:17:30.500Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00377, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-58753", "title": "copyparty: Sharing a single file does not fully restrict access to other files in source folder", "description": "Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-pxvw-4w88-6x95", "https://github.com/9001/copyparty/commit/e0a92ba72d46074209a9c304eb2a01ca0429e60c", "https://github.com/9001/copyparty/releases/tag/v1.19.8"], "fixes": ["1.19.8"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-41471", "noindex": false, "published": "2025-08-29T00:00:00.000Z", "modified": "2025-11-03T05:26:40.565Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00261, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-41471", "title": "CVE-2023-41471", "description": "Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.", "references": ["https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/copyparty.md", "https://github.com/9001/copyparty", "https://github.com/9001/copyparty/releases/tag/v1.9.2"], "fixes": [], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-54796", "noindex": false, "published": "2025-08-01T23:38:27.221Z", "modified": "2025-08-04T15:19:59.399Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-54796", "title": "Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through \"Recent Uploads\" page", "description": "Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the \"Recent Uploads\" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6", "https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83", "https://github.com/9001/copyparty/releases/tag/v1.18.9"], "fixes": ["1.18.9"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-54589", "noindex": false, "published": "2025-07-31T13:48:41.615Z", "modified": "2025-07-31T14:12:45.463Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.0239, "kev": false, "exploits": ["exploitdb", "nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-54589", "title": "copyparty Reflected XSS via Filter Parameter", "description": "Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq", "https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62", "https://github.com/9001/copyparty/releases/tag/v1.18.7"], "fixes": ["1.18.7"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-54423", "noindex": false, "published": "2025-07-28T19:53:24.109Z", "modified": "2025-07-28T20:20:15.875Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-54423", "title": "copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata", "description": "copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-9q4r-x2hj-jmvr", "https://github.com/9001/copyparty/commit/895880aeb0be0813ddf732487596633f8f9fc3a6", "https://github.com/9001/copyparty/releases/tag/v1.18.5"], "fixes": ["1.18.5"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-27145", "noindex": false, "published": "2025-02-25T01:36:46.891Z", "modified": "2025-02-25T13:59:54.943Z", "cvss": 3.6, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-27145", "title": "copyparty renders unsanitized filenames as HTML when user uploads empty files", "description": "copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as that user. For example, this could give unintended read-access to files owned by that user. The bug is triggered by the drag-drop action itself; it is not necessary to actually initiate the upload. The file must be empty (zero bytes). Note that, as a general-purpose webserver, it is intentionally pos", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-m2jw-cj8v-937r", "https://github.com/9001/copyparty/commit/438ea6ccb06f39d7cbb4b6ee7ad44606e21a63dd", "https://github.com/9001/copyparty/releases/tag/v1.16.15"], "fixes": ["1.16.15"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-38501", "noindex": false, "published": "2023-07-25T21:06:18.006Z", "modified": "2025-02-13T17:01:52.251Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.09246, "kev": false, "exploits": ["exploitdb", "nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-38501", "title": "copyparty vulnerable to reflected cross-site scripting via k304 parameter", "description": "copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh", "https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38", "http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html"], "fixes": ["1.8.7"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}, {"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "GHSA-cw7j-v52w-fp5r", "noindex": false, "published": "2023-07-21T20:20:56Z", "modified": "2025-02-14T05:29:37.302731Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-cw7j-v52w-fp5r", "title": "copyparty vulnerable to reflected cross-site scripting via hc parameter", "description": "### Summary\nThe application contains a reflected cross-site scripting via URL-parameter `?hc=...`\n\n### Details\nA reflected cross-site scripting (XSS) vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.\n\nThe worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link.\n\nIt is recommended to change the passwords of  your copyparty accounts, unless you have inspected your logs and found no trace of attacks.\n\n### ", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-cw7j-v52w-fp5r", "https://github.com/9001/copyparty/commit/0778da6c4d04de870c61f970763a7b619094093c", "https://github.com/9001/copyparty"], "fixes": ["1.8.6"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-37474", "noindex": false, "published": "2023-07-14T19:55:22.779Z", "modified": "2025-02-13T17:01:27.796Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.4492, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-37474", "title": "Path traversal in copyparty", "description": "Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg", "https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff", "http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html"], "fixes": ["1.8.2"], "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}, {"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}]}], "total": 15, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "copyparty", "path": "vulns/pypi/copyparty", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-13T16:31:17.851Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}