{"kind": "product", "path": "vulns/ubuntu-26.10/node-ajv", "name": "node-ajv", "product": "node-ajv", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-110095", "noindex": false, "published": "2026-10-20T06:56:56.456Z", "modified": "2026-10-20T16:07:47.737Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00289, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110095", "title": "fast-uri vulnerable to improper path equivalence in relative reference normalization", "description": "fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key,", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-110095"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-86818", "noindex": false, "published": "2026-09-15T10:40:38.461Z", "modified": "2026-09-15T12:31:55.631Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-86818", "title": "fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization", "description": "fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes t", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86818"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-86472", "noindex": false, "published": "2026-09-15T10:29:50.594Z", "modified": "2026-09-15T12:35:44.789Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-86472", "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets", "description": "fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist o", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86472"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-84394", "noindex": false, "published": "2026-09-02T20:25:35.399Z", "modified": "2026-09-03T13:14:42.123Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-84394", "title": "fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority", "description": "fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is n", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-84292", "noindex": false, "published": "2026-09-02T20:09:51.415Z", "modified": "2026-09-03T13:16:25.237Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00239, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-84292", "title": "fast-uri vulnerable to authority injection via an unvalidated port in serialize", "description": "fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal f", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-76172", "noindex": false, "published": "2026-08-24T10:07:56.440Z", "modified": "2026-08-24T14:29:37.950Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76172", "title": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization", "description": "fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve aga", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76172"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-75975", "noindex": false, "published": "2026-08-24T09:58:07.698Z", "modified": "2026-08-24T14:30:09.105Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-75975", "title": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization", "description": "fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An appl", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-75975"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-75899", "noindex": false, "published": "2026-08-24T09:40:19.801Z", "modified": "2026-08-24T16:19:58.701Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-75899", "title": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding", "description": "fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing,", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-75931", "noindex": false, "published": "2026-08-24T09:30:04.212Z", "modified": "2026-08-24T16:28:48.098Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00398, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-75931", "title": "fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references", "description": "fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-75931"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-18446", "noindex": false, "published": "2026-07-31T14:37:01.584Z", "modified": "2026-07-31T17:47:35.325Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18446", "title": "fast-uri vulnerable to host confusion via backslash authority introducer", "description": "fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's ", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-18446"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-16221", "noindex": false, "published": "2026-07-19T14:08:32.993Z", "modified": "2026-07-20T13:53:42.583Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00436, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-16221", "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter", "description": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before ", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx", "https://cna.openjsf.org/security-advisories.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-16221"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-13676", "noindex": false, "published": "2026-06-29T13:22:44.674Z", "modified": "2026-09-11T12:09:12.391Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00692, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-13676", "title": "fast-uri vulnerable to host confusion via failed IDN canonicalization", "description": "fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrad", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6", "https://cna.openjsf.org/security-advisories.html", "https://access.redhat.com/security/cve/CVE-2026-13676"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-6322", "noindex": false, "published": "2026-05-05T10:29:16.378Z", "modified": "2026-09-10T12:04:48.155Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00512, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6322", "title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters", "description": "fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc", "https://cna.openjsf.org/security-advisories.html", "https://access.redhat.com/security/cve/CVE-2026-6322"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-6321", "noindex": false, "published": "2026-05-04T19:31:57.253Z", "modified": "2026-09-10T12:04:59.137Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00634, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6321", "title": "fast-uri vulnerable to path traversal via percent-encoded dot segments", "description": "fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.", "references": ["https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6", "https://cna.openjsf.org/security-advisories.html", "https://access.redhat.com/security/cve/CVE-2026-6321"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-69873", "noindex": false, "published": "2026-02-11T00:00:00.000Z", "modified": "2026-09-14T12:04:32.717Z", "cvss": 2.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00547, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-69873", "title": "CVE-2025-69873", "description": "ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against a", "references": ["https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md", "https://github.com/github/advisory-database/pull/6991"], "fixes": [], "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}]}], "total": 15, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "node-ajv", "path": "vulns/ubuntu-26.10/node-ajv", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-20T16:07:47.737Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}