Third-party notices and data licenses

Where every number on this site comes from, what license it arrives under, and what that license lets anyone do with it.

How to read this

Each entry says what EVULNABLE takes from that source, the license it comes under, and what the license permits. Where a license requires its notice be reproduced word for word, the notice is printed in full rather than summarized.

EVULNABLE is not affiliated with or endorsed by CISA, FIRST or Microsoft, or by any other source listed here. Their names say where the data comes from and nothing more.

Data sources

FIRST EPSS (Exploit Prediction Scoring System)

Used for: Exploitation probability and percentile, and a rolling per-CVE score history for the sparkline on a tracked CVE's own page - the same daily file, read once a day by a background process, never per visit.
License: Published freely by FIRST; attribution requested
What it permits: FIRST's EPSS pages (read 2026-09-18) say the scores are "generated by Empirical Security and published freely to the community", with the model maintained by the EPSS Special Interest Group at FIRST; that EPSS is free to use with no registration; and that "attribution is requested when EPSS data is used in publications or products". EVULNABLE downloads the daily file from epss.empiricalsecurity.com, the address FIRST's Get the Data page gives for the same dataset, which is why Empirical Security is named here rather than listed as a separate source. FIRST is credited in the footer of every page that shows an EPSS value and in each generated report. FIRST's FAQ points to attribution guidance on its Get the Data page, but no more specific wording was found there.

NIST National Vulnerability Database (NVD)

Used for: CVE search, CVSS vectors for KEV entries CISA's own schema does not carry, and the description column of the Ubuntu rows in the Linux advisories CSV (the first listed CVE's description).
License: US Government work — not subject to copyright in the United States
What it permits: Freely usable with attribution. NIST does not endorse any product or service, and its data is provided without warranty; EVULNABLE's use of it implies no NIST endorsement of EVULNABLE.

Required license notice, in full

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE Program (cve.org)

Used for: Which CNA (vendor or coordinator) scored a CVE's CVSS, shown alongside NVD's own score, and a narrow gap-filler CVSS when NVD hasn't scored a CVE yet — labeled by CNA, never presented as NVD's own number.
License: MITRE's CVE Usage grant (cve.org/Legal/TermsOfUse)
What it permits: Permissive, no commercial restriction: a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute CVE Record content. The real condition is heavier than plain attribution: any copy made under it must reproduce MITRE's copyright designation and the license text itself, not just a credit line. EVULNABLE's current use — a CVSS number and the scoring CNA's name — stays well inside that; a future export reproducing more of a Record (description text, affected-product data) would need this notice carried into it, the same way VulnCheck's export surfaces do, and should be re-scoped before it's built.

endoflife.date

Used for: Microsoft product lifecycle milestones — end of support, end of servicing and extended-support dates.
License: MIT License
What it permits: Permissive: use, copy, modify, publish and distribute, including commercially, provided the copyright and permission notice below travel with it. That notice is why this page exists.

Required license notice, in full

Copyright (c) endoflife.date contributors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Microsoft Security Update Guide (CVRF v3.0)

Used for: The monthly Patch Tuesday CVE list — titles, MSRC severity, CVSS, exploitability signals, disclosure status and KB article numbers. The vulnerability news page also lists each monthly release's title and date, linked to Microsoft's release note.
License: No license stated at the endpoint; Microsoft's general API Terms may or may not apply
What it permits: Consumed from Microsoft's public CVRF endpoint, which requires no key and no acceptance step. Microsoft's general API Terms restrict redistributing, reselling and sublicensing API data; whether those generic terms govern this specific endpoint has not been established either way, and is being reviewed before any commercial offering. Nothing here asserts that the current free, attributed, per-entry-linked use is or is not permitted.

CyberSecurityTracker.ai

Used for: Fixed versions, vendor-required actions and remediation guidance per CVE.
License: Permission to use granted by the site owner to EVULNABLE, 2026-09-19
What it permits: Accessed through the project's public MCP endpoint and data shards, which need no key. Permission to use granted by the site owner to EVULNABLE, 2026-09-19. EVULNABLE also honors the source's published fair-use guidance — cache headers respected and sustained polling held at or under one request per second, enforced in code rather than intended — and carries each value's own upstream attribution through to the page.

Check Point Research

Used for: Per-CVE threat research coverage.
License: Headline, date and link only
What it permits: EVULNABLE stores and shows the title, the publication date and a link to Check Point's own write-up. No article text is copied, and every reference sends the reader to the original.

Linux distribution security feeds

Used for: Red Hat, Ubuntu and Debian security advisories: the advisory or CVE number, its title, its date and the CVE numbers, each linked to the distribution's own page. Red Hat's critical and important CVEs also appear as headlines on the vulnerability news page, each linked to Red Hat's own CVE page.
License: Red Hat: Creative Commons Attribution 4.0. Debian: MIT (Expat). Ubuntu: Creative Commons Attribution-ShareAlike 4.0
What it permits: Red Hat (access.redhat.com/security/data): the security data pages say the data resources "are licensed under the Creative Commons Attribution 4.0 International License" and that "If you distribute this content or a modified version of it, you must provide attribution to Red Hat", with a link to the original; every Red Hat row links to Red Hat's own CVE page and the credit is printed with the rows and in the CSV. Debian (debian.org/license): material since 25 January 2012 "can be redistributed and/or modified under the terms of the MIT (Expat) License"; the site footer reads "Copyright © 1997-2026 SPI and others"; every Debian row links to Debian's own advisory and the credit is printed with the rows and in the CSV. Ubuntu: the rows come from Canonical's own OSV data, the canonical/ubuntu-security-notices repository on GitHub (github.com/canonical/ubuntu-security-notices), which Canonical's security documentation names as a source of its OSV feed, and whose README states "This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License". EVULNABLE credits Canonical Ltd. and that license beside the Ubuntu rows on the Patch Advisories page and in the CSV, shows only the notice number, title, date and CVE numbers with a link to Canonical's notice page, and carries none of Canonical's description text (the CSV's description for an Ubuntu row is the NVD description of its first CVE). Canonical's security team recommended these OSV data feeds to EVULNABLE for this use. Advisory text beyond that is not copied; each entry points the reader at the distribution's own advisory.

Vendor security bulletins

Used for: Adobe, Apple, Google Chrome, Cisco, Ivanti and Oracle advisories.
License: Metadata and links only
What it permits: EVULNABLE lists each bulletin's title, date and identifiers and links to the vendor's own page. Cisco PSIRT is read through its openVuln API, whose terms attach to the API key.

Shodan

Used for: The Domain Security Check's Shodan lookup — open ports, fingerprinted service banners and Shodan's own CVE-by-fingerprint matches for a domain's resolved IP, shown on the page and in its CSV and PDF exports.
License: Commercial API, keyed access
What it permits: "Yes, you can integrate the API in your products as long as the data is attributed to Shodan." (https://developer.shodan.io/pricing). EVULNABLE credits Shodan wherever a lookup's results are shown, including the CSV and PDF exports.

SSLMate Certificate Search

Used for: The Domain Security Check's opt-in certificate history - the unexpired certificates Certificate Transparency logs hold for a domain (issuer, issuance date, other names seen on the same certificates), shown on the results page and in its CSV export.
License: Commercial API, keyed access; written permission
What it permits: SSLMate's founder (Andrew Ayer) answered EVULNABLE in writing, on 2026-10-06, verbatim: "Yes, commercial use in paid reports is permitted on all plans. On the free (Small) plan, the certificate history must be accompanied, immediately above or below it, by legible text no smaller than the surrounding text that reads 'Certificate Transparency data from SSLMate Certificate Search'. Where the format supports links (e.g. web page, PDF), it must link to <https://sslmate.com/ct_search_api/>. Alternative wording requires our written approval. The paid plans do not require attribution." (The reply's inner quotation marks are shown as single quotes here.) EVULNABLE prints that exact line, linked, directly under the certificate history's heading on the results page, in the page's own text size, and as the last line of the CSV export (a CSV cannot carry a link, so the address follows in plain text). The key is a file secret; SSLMate is never queried without it, and a scan with no key reports the history as not checked. The free plan's limit, 100 single-hostname queries an hour, is respected by a per-scan cap, a one-day cache and a rolling-hour budget (webui/ct_history_view.py). SSLMate's documentation says the endpoint lists unexpired issuances, so the page says 'unexpired' wherever it counts them.

Metasploit Framework module metadata

Used for: The CVE Lookup page's "public exploit module exists" cross-reference — display-only, never fed into EVRS scoring.
License: BSD-3-Clause
What it permits: Permissive: use, copy, modify and redistribute, including commercially, provided the copyright notice, the conditions and the disclaimer below travel with it, and Rapid7's name is not used to endorse a derived product without its permission — EVULNABLE makes no such endorsement claim. The data itself is db/modules_metadata_base.json, a bulk metadata file Rapid7 generates and commits to the framework repository on every release, covered by the same top-level "Files: *" BSD-3-Clause grant in the repository's LICENSE file as the rest of the framework (verified directly against that file, not assumed from the project's general reputation) — it is not one of the file's separately-licensed third-party exceptions.

Required license notice, in full

Copyright (c) 2006-2026, Rapid7, Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Rapid7, Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ENISA EUVD (European Union Vulnerability Database)

Used for: The CVE Lookup page's "ENISA EUVD also lists this CVE" line — the base score, its version and the assigner ENISA publishes for that exact CVE, display-only and never fed into EVRS scoring.
License: ENISA Legal Notice — reproduction authorized with acknowledgment of the source
What it permits: ENISA's Legal Notice (enisa.europa.eu/about-enisa/legal-notice, fetched and confirmed live 2026-09-17) states: "Reproduction of ENISA material published on this website is authorized, provided the source is acknowledged, unless it is stated otherwise." EVULNABLE names ENISA EUVD and links to the record beside every figure it shows, so the number can always be traced back to ENISA. Checked in a browser on 2026-09-18: EUVD's own pages, including its API documentation, carry exactly one legal link, the footer's "Legal Notice", which points at this same ENISA notice, and the notice itself requires any restriction to be published "on that specific material", which EUVD does not do; the footer also reads "© 2025 by the European Union Agency for Cybersecurity", and the notice's definition of its material includes "data". One point is left open, which is why this entry is marked verify rather than settled: the authorization is for material "published on this website" and EUVD sits on an enisa.europa.eu subdomain. Whether that subdomain is "this website" is a legal judgment, not a factual one, so it is left for a person to decide. Only the fields named above are read, from the per-CVE search API at euvdservices.enisa.europa.eu; EUVD's own exploited-vulnerabilities list is a four-record widget feed rather than a catalog and is deliberately not used, and its "epss" field is dropped because it is published on a 0-100 percentage scale while EVULNABLE treats EPSS as a 0-1 probability.

GitHub Advisory Database

Used for: The CVE Lookup page's "GitHub advisory" cross-reference - display-only, never fed into EVRS scoring.
License: CC-BY-4.0
What it permits: Permissive: share and adapt, including commercially, provided appropriate credit is given, a link to the license is provided, and any changes are indicated. EVULNABLE credits GitHub on every advisory line it shows, links the CC-BY-4.0 license there, and changes nothing in the advisory text it displays. The database's repository (github/advisory-database) states it is "licensed under the terms of the CC-BY 4.0 open source license"; the API this project reads serves the same advisories.

Required license notice, in full

Advisory information shown on the CVE Lookup page comes from the GitHub Advisory Database (https://github.com/advisories), (c) GitHub, Inc. and the advisory contributors, licensed under the Creative Commons Attribution 4.0 International license (https://creativecommons.org/licenses/by/4.0/). EVULNABLE displays the advisory's identifier, summary and affected package ecosystems unmodified, links each one to its GitHub advisory page, and does not alter or combine them with other data. The vulnerability news page shows each advisory's summary as its headline, unmodified, linked to its GitHub advisory page. The material is provided "as is" without warranties of any kind; GitHub does not endorse EVULNABLE.

CERT-EU security advisories

Used for: The vulnerability news page: each advisory's title and date, linked to CERT-EU's own publication.
License: Creative Commons Attribution 4.0 International
What it permits: CERT-EU's legal notice (cert.europa.eu/legal-notice, read 2026-10-13) allows reuse of its documents under the Creative Commons Attribution 4.0 International license, with appropriate credit given and changes indicated. EVULNABLE names CERT-EU and links the license on every row, links the original publication, and shows the title as published, so there is no change to indicate. Only the title, date and link are used; an advisory's own text is not copied.

Required license notice, in full

Advisory titles shown on the vulnerability news page come from CERT-EU's security advisories (https://cert.europa.eu/publications/security-advisories/), (c) CERT-EU, reused under the Creative Commons Attribution 4.0 International license (https://creativecommons.org/licenses/by/4.0/). EVULNABLE shows each advisory's title and date unmodified and links each one to the original publication.

VulnCheck KEV

Used for: The CVE Lookup page's "VulnCheck KEV" known-exploited flag, shown only for a CVE VulnCheck lists and CISA does not - display-only, never fed into EVRS scoring, and not included in any export.
License: VulnCheck Service Terms (Community free offering)
What it permits: VulnCheck's published Attribution Notice (docs.vulncheck.com/community/vulncheck-kev/attribution, read 2026-09-18) says VulnCheck KEV and its data may be used in a product or service at no additional cost, provided there is prominent attribution: the data is labeled "VulnCheck Known Exploited Vulnerabilities" or "VulnCheck KEV". The Service Terms (revised 20 April 2026) incorporate the Documentation for the form and format of the attribution notice, and separately provide: a product incorporating a Free Offering must show the attribution notice in its user interface and in any outputs of the product, derived figures included; the data may not be made available for free or under an open source or similar license, nor used to develop, train or fine-tune an AI model (EVULNABLE keeps it out of AI prompts as well). The Community edition is a one-month Initial Term that renews automatically and can be ended by either side on 30 days' notice; the 30-day term is for free trials only. EVULNABLE labels the flag "VulnCheck KEV" on the one page that shows it and keeps the data out of every export, because the Terms' "any outputs" wording would apply to all of them. VulnCheck's published Attribution Notice permits this use with the label “VulnCheck KEV”.

Required license notice, in full

Known-exploited flags shown on the CVE Lookup page for vulnerabilities CISA's catalog does not list come from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), https://vulncheck.com/kev, provided by VulnCheck, Inc. under its Community free offering and Service Terms (https://www.vulncheck.com/service-terms). EVULNABLE labels every use of this data "VulnCheck KEV", does not use it in any EVULNABLE risk score, and does not redistribute it as a raw feed. The data is provided "as is"; VulnCheck does not endorse EVULNABLE.

RDAP domain registration data (registry operators)

Used for: The registration details on each Domain Security Check domain card and in its PDF: registrar, registration state, created and expiry dates, registrar status. The report footer credits "RDAP registration data".
License: Per-registry terms of use, carried in each RDAP response
What it permits: RDAP records come from each top-level domain's own registry operator (Verisign for .com and .net, Public Interest Registry for .org, Nominet for .uk, and so on; IANA's bootstrap registry, below, says which), and every response carries a terms notice. Four registries put their terms in the response itself (Public Interest Registry, Nominet, Google Registry, Identity Digital); Verisign, which runs .com and .net, sends only "Service subject to Terms of Use" with a link, so its terms are on a separate page, which was read on 2026-09-18 (verisign.com, Registration Data Access Protocol terms of service). Across those five the data is provided for information only with no guarantee of accuracy, for lawful purposes only, and not to support mass unsolicited commercial advertising; all five also bar using it to "enable high volume, automated, electronic processes that send queries or data to the systems of" the registry or its registrars (Verisign's wording, from its terms page; the others' are close to it). The clause sits in the registry's response for four of the five and only behind a link for .com and .net. Nominet's terms go further for .uk: "You are explicitly prohibited from extracting, copying and/or using or re-using in any form and by any means (electronically or not) all or part (quantitatively or qualitatively) of the contents of the RDAP database without prior and explicit permission from the Registry Operator. Any copying or transmission of data for commercial purposes violates this prohibition." EVULNABLE looks up a visitor's own domain on request, shows a handful of the fields in that visitor's result and PDF, credits the source, and does not keep or resell the records; it has not asked any registry for permission, and whether that use fits the Nominet clause, or the "high volume, automated" clause at up to 100 domains a run, has not been decided. Not every registry was read: IANA's bootstrap file lists no RDAP service at all for .io or .de.

Software and typefaces

Barlow / Barlow Condensed

Used for: The Enhanced Due Diligence report sheet, which is set as a document rather than in the site UI face.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

Instrument Sans

Used for: The typeface on every page and in every generated PDF.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

Sora

Used for: Display type on the /build page and body type on the /brief page.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

Oxanium

Used for: Display type on the /brief page.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

Onest

Used for: Body type on the /build page.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

IBM Plex Mono

Used for: CVE identifiers, KB numbers, hostnames and IP addresses — anything a reader might copy.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

JetBrains Mono

Used for: Monospace text: domain names, records and codes on the Domain Security Check and in the PDF exports, and the copyright year in the shared footer.
License: SIL Open Font License 1.1
What it permits: Licensed under the SIL Open Font License 1.1. The fonts may be used, studied, modified and redistributed freely so long as they are not sold on their own; the full license text ships beside the font files.

pptxgenjs

Used for: Renders the Patch Tuesday Briefing .pptx download — reports/pptx_deck/build.js's only dependency, built into the app image via npm ci.
License: MIT License
What it permits: Permissive: use, copy, modify, publish and distribute, including commercially, provided the copyright and permission notice below travel with it.

Required license notice, in full

The MIT License (MIT) Copyright (c) 2015-2022 Brent Ely Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

PapaParse

Used for: In-browser CSV parsing for the pre-upload column detection step, vendored under webui/static/js/vendor/.
License: MIT License
What it permits: Permissive: use, copy, modify, publish and distribute, including commercially, provided the copyright and permission notice below travel with it.

Required license notice, in full

The MIT License (MIT) Copyright (c) 2015 Matthew Holt Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

htmx

Used for: Partial page updates: the filtering and paging on every page, vendored under webui/static/js/vendor/.
License: Zero-Clause BSD
What it permits: No conditions: use, copy, modify and distribute for any purpose with or without fee. Nothing has to be reproduced; the text below is shown so the source is credited. (An earlier note in the vendor directory called this BSD 2-Clause; upstream's LICENSE at v2.0.4 says Zero-Clause.)

Required license notice, in full

Zero-Clause BSD ============= Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted. THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

SheetJS (xlsx)

Used for: In-browser .xlsx export of the Watchlist, vendored under webui/static/js/vendor/.
License: Apache License 2.0
What it permits: Permissive: use, copy, modify and distribute, including commercially, provided a copy of the license and the copyright notice travel with it (Apache-2.0 section 4). The vendored file is unmodified and this version ships no NOTICE file. The license and copyright are reproduced below.

Required license notice, in full

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "{}" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright (C) 2012-present SheetJS LLC Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

jsPDF

Used for: In-browser PDF export of the Watchlist, vendored under webui/static/js/vendor/. The served file also carries its own, longer contributor banner.
License: MIT License
What it permits: Permissive: use, copy, modify, publish and distribute, including commercially, provided the copyright and permission notice below travel with it.

Required license notice, in full

Copyright (c) 2010-2021 James Hall, https://github.com/MrRio/jsPDF (c) 2015-2021 yWorks GmbH, https://www.yworks.com/ Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

What EVULNABLE adds

The facts above are not EVULNABLE's to license — a CVE identifier, a CISA KEV listing and an EPSS probability belong to the bodies that publish them, and this site passes them through with attribution.

What EVULNABLE creates on top of them is the EVULNABLE Risk Score, its band vocabulary, the written summaries and comparisons, and the generated reports. Terms covering the reuse of those are being written. Until they are published, treat EVULNABLE-created content as all rights reserved and ask — the answer is likely to be yes, and it is better recorded than assumed.

Something wrong here?

If you maintain one of these sources and EVULNABLE has mischaracterized your license, credited you incorrectly, or is using your data in a way you did not intend, say so and it will be corrected or the use stopped. That is a faster route than a legal one and it is the one this project would rather you take.