{"kind": "product", "path": "vulns/pypi/scrapy", "name": "scrapy", "product": "scrapy", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-105782", "noindex": false, "published": "2026-10-05T23:08:55.749Z", "modified": "2026-10-06T13:44:10.445Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00378, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105782", "title": "Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware", "description": "Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7", "https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5", "https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0"], "fixes": ["2.14.2"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-84366", "noindex": false, "published": "2026-09-01T20:29:23.143Z", "modified": "2026-09-02T16:02:19.564Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00254, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-84366", "title": "Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default", "description": "Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta[\"is_secure\"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-midd", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx", "https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b", "https://github.com/scrapy/scrapy/releases/tag/2.17.0"], "fixes": ["2.17", "2.17.0"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-6176", "noindex": false, "published": "2025-10-31T00:00:21.219Z", "modified": "2025-10-31T16:21:32.237Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00545, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-6176", "title": "Brotli decompression bomb DoS in scrapy/scrapy", "description": "Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.", "references": ["https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0", "https://nvd.nist.gov/vuln/detail/CVE-2025-6176"], "fixes": ["2.13.4"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-1968", "noindex": false, "published": "2024-05-20T08:03:43.129Z", "modified": "2024-08-01T18:56:22.474Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00688, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-1968", "title": "Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects", "description": "In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.", "references": ["https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a", "https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8", "https://nvd.nist.gov/vuln/detail/CVE-2024-1968"], "fixes": ["2.0.0", "2.11.2"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "GHSA-23j4-mw76-5v7h", "noindex": false, "published": "2024-05-14T20:14:49Z", "modified": "2024-11-28T05:42:50.070417Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-23j4-mw76-5v7h", "title": "Scrapy allows redirect following in protocols other than HTTP", "description": "### Impact\n\nScrapy was following redirects regardless of the URL protocol, so redirects were working for `data://`, `file://`, `ftp://`, `s3://`, and any other scheme defined in the `DOWNLOAD_HANDLERS` setting.\n\nHowever, HTTP redirects should only work between URLs that use the `http://` or `https://` schemes.\n\nA malicious actor, given write access to the start requests (e.g. ability to define `start_urls`) of a spider and read access to the spider output, could exploit this vulnerability to:\n- Redirect to any local file using the `file://` scheme to read its contents.\n- Redirect to an `ftp://` URL of a malicious FTP server to obtain the FTP ", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-23j4-mw76-5v7h", "https://github.com/scrapy/scrapy/issues/457", "https://github.com/scrapy/scrapy/commit/36287cb665ab4b0c65fd53181c9a0ef04990ada6"], "fixes": ["2.11.2"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "GHSA-jm3v-qxmh-hxwv", "noindex": false, "published": "2024-05-14T20:14:43Z", "modified": "2024-11-28T05:39:05.360305Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-jm3v-qxmh-hxwv", "title": "Scrapy's redirects ignoring scheme-specific proxy settings", "description": "### Impact\n\nWhen using system proxy settings, which are scheme-specific (i.e. specific to `http://` or `https://` URLs), Scrapy was not accounting for scheme changes during redirects.\n\nFor example, an HTTP request would use the proxy configured for HTTP and, when redirected to an HTTPS URL, the new HTTPS request would still use the proxy configured for HTTP instead of switching to the proxy configured for HTTPS. Same the other way around.\n\nIf you have different proxy configurations for HTTP and HTTPS in your system for security reasons (e.g., maybe you don’t want one of your proxy providers to be aware of the URLs that you visit with the othe", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-jm3v-qxmh-hxwv", "https://github.com/scrapy/scrapy/issues/767", "https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8"], "fixes": ["2.11.2"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-3574", "noindex": false, "published": "2024-04-16T00:00:15.109Z", "modified": "2024-08-01T20:12:08.239Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00648, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-3574", "title": "Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy", "description": "In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.", "references": ["https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9", "https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75", "https://nvd.nist.gov/vuln/detail/CVE-2024-3574"], "fixes": ["1.8.4", "2.11.1"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-3572", "noindex": false, "published": "2024-04-16T00:00:14.499Z", "modified": "2024-08-01T20:12:07.961Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00814, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-3572", "title": "XML External Entity (XXE) Vulnerability in scrapy/scrapy", "description": "The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. ", "references": ["https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb", "https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f", "https://nvd.nist.gov/vuln/detail/CVE-2024-3572"], "fixes": ["1.8.4", "2.11.1"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-1892", "noindex": false, "published": "2024-02-28T00:00:14.092Z", "modified": "2024-08-11T14:28:49.917Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00557, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-1892", "title": "ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider", "description": "A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.", "references": ["https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b", "https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5", "https://nvd.nist.gov/vuln/detail/CVE-2024-1892"], "fixes": ["1.8.4", "2.11.1"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "GHSA-9x8m-2xpf-crp3", "noindex": false, "published": "2022-07-29T22:26:57Z", "modified": "2024-11-28T05:41:04.660880Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-9x8m-2xpf-crp3", "title": "Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another", "description": "### Impact\n\nWhen the [built-in HTTP proxy downloader middleware](https://docs.scrapy.org/en/2.6/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpproxy) processes a request with `proxy` metadata, and that `proxy` metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the `Proxy-Authentication` header, but only if that header is not already set.\n\nThere are third-party proxy-rotation downloader middlewares that set different `proxy` metadata every time they process a request.\n\nBecause of request retries and redirects, the same request can be processed by downloader middlewares more than o", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-9x8m-2xpf-crp3", "https://github.com/scrapy/scrapy/commit/af7dd16d8ded3e6cb2946603688f4f4a5212e80f", "https://github.com/scrapy/scrapy"], "fixes": ["1.8.3", "2.6.2"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-0577", "noindex": false, "published": "2022-03-02T04:05:10.000Z", "modified": "2024-08-02T23:32:46.259Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01228, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-0577", "title": "Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy", "description": "Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.", "references": ["https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585", "https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a", "https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html"], "fixes": ["1.8.2", "2.6.0", "2.6.1"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "GHSA-mfjm-vh54-3f96", "noindex": false, "published": "2022-03-01T22:13:28Z", "modified": "2024-12-07T05:40:29.120017Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-mfjm-vh54-3f96", "title": "Scrapy cookie-setting is not restricted based on the public suffix list", "description": "### Impact\n\nResponses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.\n\n### Patches\n\nUpgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the [public suffix list](https://publicsuffix.org/).\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.\n\n### Workarounds\n\nThe only workaround for unpatched version", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-mfjm-vh54-3f96", "https://github.com/scrapy/scrapy/commit/e865c4430e58a4faa0e0766b23830f8423d6167a", "https://github.com/scrapy/scrapy"], "fixes": ["1.8.2", "2.6.0"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2021-41125", "noindex": false, "published": "2021-10-06T17:15:13.000Z", "modified": "2024-08-04T02:59:31.432Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.01261, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2021-41125", "title": "HTTP authentication credential leak to target websites in scrapy", "description": "Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target. This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects. Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials. If you are using Scrapy 1.8 or a l", "references": ["https://github.com/scrapy/scrapy/security/advisories/GHSA-jwqp-28gf-p498", "https://github.com/scrapy/scrapy/commit/b01d69a1bf48060daec8f751368622352d8b85a6", "https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.http.basic_auth_header"], "fixes": ["1.8.1", "2.5.1"], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}, {"id": "CVE-2017-14158", "noindex": false, "published": "2017-09-05T17:00:00.000Z", "modified": "2024-08-05T19:20:41.277Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02605, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2017-14158", "title": "CVE-2017-14158", "description": "Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.", "references": ["https://github.com/scrapy/scrapy/issues/482", "http://blog.csdn.net/wangtua/article/details/75228728", "https://nvd.nist.gov/vuln/detail/CVE-2017-14158"], "fixes": [], "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}, {"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "scrapy", "path": "vulns/pypi/scrapy", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-06T13:44:10.445Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}