Skip to content

Licensing Appendix

The Vulnetix Vulnerability Database aggregates data from 160+ upstream sources. Each record is served with its origin tagged, and the upstream source’s licence terms apply to that record’s content. This appendix groups sources by their redistribution terms.

Vulnetix does not assert a proprietary licence over community/open vulnerability data. Our model is pass-through: upstream content is served as-is, tagged with its source. Vulnetix-authored enrichment fields (proprietary analysis, malware linkage, safe harbour scoring) are clearly distinguished and covered by commercial terms only.

Public Domain / US Government Works

US government publications are not subject to copyright under 17 U.S.C. § 105. Redistribution is unrestricted.

CC-BY 4.0 / CC-BY-SA

Creative Commons Attribution licences. Redistribution permitted with attribution to the original source.

CC0 / Open Data

Public domain dedication or equivalent open data terms. No restrictions on redistribution.

CC-BY-NC-SA / Non-Commercial

Creative Commons Attribution-NonCommercial-ShareAlike. Redistribution permitted for non-commercial purposes only; derivatives must use the same licence.

  • VARIoT (CC-BY-NC-SA-4.0 — EU-funded IoT project; commercial redistribution prohibited)

Apache 2.0 / MIT / Open Source

Standard open source licences. Redistribution permitted under licence terms.

Vendor Terms — Redistribution Generally Permitted

Vendor-published advisories where redistribution is permitted or implied through public RSS/CSAF feeds. Attribution required.

Vendor Terms — Redistribution Restrictions Apply

Sources with explicit redistribution limitations. Data may be available for informational use but redistribution requires review.

  • NCSC-NL CSAF — "No rights derivable (informational use)"
  • NCSC-NL Nieuwsberichten — "No rights derivable" applies to news articles as well
  • CERT-JP Advisory — Notification required for redistribution
  • CERT-BE — Redistribution of copyrighted material requires prior written permission from Centre for Cybersecurity Belgium
  • CNVD Advisory (China) — Proprietary; bulk export prohibited
  • FSTEC BDU (Russia) — Government restricted
  • Siemens CSAF — Subject to Siemens website terms; explicit commercial redistribution not permitted without authorisation
  • SAP NetWeaver — Customer-only access terms
  • D-Link Firmware — Vendor terms apply
  • OpenBSD — BSD licence; advisory text terms vary
  • ExploitDB — OffSec; website terms explicitly prohibit reproducing, duplicating, or reselling any portion without written permission
  • AttackerKB — Rapid7 proprietary; redistribution rights reserved by Rapid7
  • HackerOne Hacktivity — Authenticated API subject to HackerOne ToS (non-sublicensable, non-transferable); see also Implicit / No Stated Licence for the unauthenticated public GraphQL data we use
  • Shadowserver — Data redistribution and resale prohibited per Shadowserver terms

Commercial / Membership Required

Sources requiring paid subscription, membership, or commercial licence agreement. Data availability may vary by tier.

Third-Party Scores — Attributed

Publicly available scoring systems surfaced with attribution. Redistribution confirmation pending from respective owners.

  • Coalition ESS — Exploit Scoring System by Coalition Inc. Redistribution confirmation pending.
  • EPSS — Exploit Prediction Scoring System by FIRST.org. Redistribution confirmation pending.

Implicit / No Stated Licence

Sources published via RSS feeds or public web pages without explicit redistribution terms. Our position is that publishing an advisory feed constitutes an implicit licence to consume and aggregate for the purpose it was published.

OSV ecosystem package-level advisories (npm, Maven, NuGet, crates.io, Hex, Packagist, Pub, RubyGems, SwiftURL, R CRAN/Bioconductor, curl, git, GitHub Actions, and others) follow the terms of their upstream advisory database — typically GHSA (CC-BY 4.0) or Google OSV (Apache 2.0).

This appendix reflects our current understanding of upstream licence terms as of April 2026. Source licences may change. For the latest terms, refer to each source directly. Sources with redistribution restrictions are being reviewed by legal counsel.