# TuxCare advisory feed: sources and licences

This feed redistributes vulnerability data from the sources below. Each record
keeps the licence of its source. Each OSV record keeps its own `credits`,
`references` and `database_specific.source` fields unchanged. The licence
texts are in `LICENSES/`.

TuxCare built this feed. No source below endorses this feed or TuxCare.

## `osv` stream: OSV records from OSV.dev

OSV.dev (https://osv.dev) collects the records from the sources below. OSV.dev
states no licence for the combined data. The licence of each record is the
licence of its source, which the id prefix shows.

| Id prefix | Source | Licence |
|---|---|---|
| `GHSA-` | GitHub Advisory Database, https://github.com/advisories | CC-BY-4.0 |
| `PYSEC-` | PyPA Advisory Database, https://github.com/pypa/advisory-database | CC-BY-4.0 |
| `PSF-` | Python Software Foundation advisories | CC-BY-4.0 |
| `OSV-` | OSS-Fuzz, https://github.com/google/oss-fuzz-vulns | CC-BY-4.0 |
| `GO-` | Go Vulnerability Database, https://pkg.go.dev/vuln | CC-BY-4.0 |
| `JLSEC-` | Julia security advisories | CC-BY-4.0 |
| `EEF-` | Erlang Ecosystem Foundation CNA, https://cna.erlef.org | CC-BY-4.0 |
| `RHSA-`, `RHBA-`, `RHEA-` | Red Hat, https://access.redhat.com/security/data | CC-BY-4.0 |
| `SUSE-`, `openSUSE-` | SUSE, https://www.suse.com/support/security/ | CC-BY-4.0 |
| `USN-`, `UBUNTU-`, `LSN-` | Canonical Ubuntu, https://ubuntu.com/security | CC-BY-SA-4.0 |
| `RUSTSEC-` | RustSec Advisory Database, https://rustsec.org | CC0-1.0; content that RustSec copied from GHSA is CC-BY-4.0 |
| `HSEC-` | Haskell Security Response Team | CC0-1.0 |
| `OSEC-` | opam security advisories | CC0-1.0 |
| `GSD-` | Global Security Database | CC0-1.0 |
| `ALSA-`, `ALBA-`, `ALEA-` | AlmaLinux OS Foundation, https://errata.almalinux.org | MIT |
| `DRUPAL-` | Drupal Security Team | MIT |
| `AZL-` | Microsoft Azure Linux | MIT |
| `BELL-` | BellSoft | MIT |
| `RLSA-`, `RXSA-` | Rocky Enterprise Software Foundation, https://errata.rockylinux.org | BSD-3-Clause |
| `MAL-` | OpenSSF Malicious Packages, https://github.com/ossf/malicious-packages | Apache-2.0 |
| `RSEC-` | R Consortium advisories | Apache-2.0 |
| `BIT-` | Bitnami Vulnerability Database | Apache-2.0 |
| `CLEANSTART-` | CleanStart advisories | Apache-2.0 |
| `V8-` | V8 advisories | Apache-2.0 |
| `CVE-` | OSV.dev records converted from the CVE List and NVD | See the `cve` stream below |
| `DSA-`, `DLA-`, `DTSA-`, `DEBIAN-` | Debian Security Tracker | Not stated by the source |
| `ALPINE-` | Alpine Linux secdb | Not stated by the source |
| `A-`, `ASB-A-`, `PUB-A-` | Android Security Bulletins | Not stated by the source |
| `CURL-` | curl | Not stated by the source |
| `MGASA-` | Mageia | Not stated by the source |
| `OESA-` | openEuler | Not stated by the source |
| `CLSA-` | TuxCare | TuxCare |

The feed does not carry the records of these commercial vendors:

| Id prefix | Vendor | Reason |
|---|---|---|
| `CGA-` | Chainguard and Wolfi | Their licence (CC-BY-NC-ND-4.0 and the Chainguard licence for scanners) does not allow redistribution. |
| `ECHO-` | Echo | The vendor states no licence that allows redistribution. |
| `ROOT-` | Root | The vendor states no licence that allows redistribution. |
| `MINI-` | MinimOS | The vendor states no licence that allows redistribution. |

The sources marked "Not stated by the source" are distro and project teams
that publish their records openly. The feed carries those records unchanged,
with their references to the source.

Notices:

- GitHub Advisory Database: each `GHSA-` record is available at
  `https://github.com/advisories/<id>`.
- Red Hat: "If you distribute this content or a modified version of it, you
  must provide attribution to Red Hat and provide a link to the original."
  Each record's `references` hold the link.
- Ubuntu: records from Canonical are licensed CC-BY-SA-4.0. Anyone who
  shares them must share them under the same licence.
- MIT and BSD sources: the copyright holders are the organisations named in
  the table above. The licence texts are `LICENSES/MIT.txt` and
  `LICENSES/BSD-3-Clause.txt`.
- OpenSSF Malicious Packages: Copyright The OpenSSF Malicious Packages
  authors. Licensed under the Apache License, Version 2.0
  (`LICENSES/Apache-2.0.txt`). The repository has no NOTICE file.

## `cve` stream

- **CVE List.** The CVE Program, https://www.cve.org. Copyright © 1999-2026,
  The MITRE Corporation. CVE is a trademark and the CVE logo is a registered
  trademark of The MITRE Corporation. Used under the CVE Terms of Use
  (`LICENSES/LicenseRef-CVE-Terms-of-Use.txt`).
- **NVD.** This product uses data from the NVD API but is not endorsed or
  certified by the NVD. The `cve` lines are a projection of NVD records, so
  they do not name the NVD as the source of the modified content.
- **CISA ADP (Vulnrichment).** SSVC decisions and CVSS vectors of the
  CISA-ADP container: CC0-1.0, https://github.com/cisagov/vulnrichment.

## `exploited` stream

- **`cisa_kev`.** The CISA Known Exploited Vulnerabilities catalogue,
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog. CC0-1.0. Use
  of the data does not authorize use of the CISA logo or the DHS seal, and is
  not an endorsement by CISA or DHS.
- **`cve_adp`.** SSVC decisions of the CISA-ADP container: CC0-1.0.
- **`euvd`.** Contains data from the EU Vulnerability Database (EUVD),
  © European Union Agency for Cybersecurity (ENISA),
  https://euvd.enisa.europa.eu/. Reproduced under the ENISA legal notice,
  https://www.enisa.europa.eu/about-enisa/legal-notice/legal-notice. ENISA
  does not endorse this feed.