Attributions

Known vulnerabilities, fixed versions and malicious-package advisories in dependency findings and the SBOM.

Licence: Aggregated from upstream databases, each under its own terms (including the GitHub Advisory Database, below).

Known vulnerabilities in container-image findings.

Licence: Database tooling under Apache-2.0; the data is aggregated from upstream sources under their own terms, including the National Vulnerability Database, the GitHub Advisory Database and vendor advisories.

Advisory records received through OSV and the Trivy database.

Licence: Creative Commons Attribution 4.0 International (CC BY 4.0)

Declared package licences in licence-compliance findings.

Licence: Creative Commons Attribution 4.0 International (CC BY 4.0)

Exploit-probability scores on vulnerability findings.

Licence: Free to use with attribution, per FIRST's EPSS FAQ.

Flagging vulnerabilities known to be exploited in the wild.

Licence: A work of the U.S. federal government, in the public domain. Credited as a courtesy.

Weakness identifiers (CWE IDs) on findings.

Licence: CWE Terms of Use

Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE's copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation.

Category identifiers and names (for example, A10:2021) on findings. Hypervex references categories only and does not reproduce OWASP's descriptive text.

Licence: Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)

OWASP Top 10, © the OWASP Foundation, licensed under CC BY-SA 4.0.