{"url":"http://public2.vulnerablecode.io/api/packages/213854?format=json","purl":"pkg:deb/debian/rxvt-unicode@9.07-2%2Bdeb6u1","type":"deb","namespace":"debian","name":"rxvt-unicode","version":"9.07-2+deb6u1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"9.22-11","latest_non_vulnerable_version":"9.31-3","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/66669?format=json","vulnerability_id":"VCID-8fw6-kn6y-nucp","summary":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33477","reference_id":"","reference_type":"","scores":[{"value":"0.01208","scoring_system":"epss","scoring_elements":"0.79303","published_at":"2026-06-04T12:55:00Z"},{"value":"0.01208","scoring_system":"epss","scoring_elements":"0.7933","published_at":"2026-06-05T12:55:00Z"},{"value":"0.01208","scoring_system":"epss","scoring_elements":"0.79335","published_at":"2026-06-06T12:55:00Z"},{"value":"0.01208","scoring_system":"epss","scoring_elements":"0.79328","published_at":"2026-06-07T12:55:00Z"},{"value":"0.01208","scoring_system":"epss","scoring_elements":"0.79317","published_at":"2026-06-08T12:55:00Z"},{"value":"0.01208","scoring_system":"epss","scoring_elements":"0.79336","published_at":"2026-06-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33477"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33477","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33477"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988763","reference_id":"988763","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988763"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989041","reference_id":"989041","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989041"},{"reference_url":"https://security.gentoo.org/glsa/202105-17","reference_id":"GLSA-202105-17","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202105-17"},{"reference_url":"https://security.gentoo.org/glsa/202209-07","reference_id":"GLSA-202209-07","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202209-07"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1076222?format=json","purl":"pkg:deb/debian/rxvt-unicode@9.22-11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/rxvt-unicode@9.22-11"}],"aliases":["CVE-2021-33477"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8fw6-kn6y-nucp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/100561?format=json","vulnerability_id":"VCID-dgmw-f5yj-63ge","summary":"rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3121","reference_id":"","reference_type":"","scores":[{"value":"0.03336","scoring_system":"epss","scoring_elements":"0.8752","published_at":"2026-06-04T12:55:00Z"},{"value":"0.03336","scoring_system":"epss","scoring_elements":"0.87541","published_at":"2026-06-05T12:55:00Z"},{"value":"0.03336","scoring_system":"epss","scoring_elements":"0.87539","published_at":"2026-06-06T12:55:00Z"},{"value":"0.03336","scoring_system":"epss","scoring_elements":"0.87538","published_at":"2026-06-07T12:55:00Z"},{"value":"0.03336","scoring_system":"epss","scoring_elements":"0.87537","published_at":"2026-06-08T12:55:00Z"},{"value":"0.03336","scoring_system":"epss","scoring_elements":"0.87548","published_at":"2026-06-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3121"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3121","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3121"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746593","reference_id":"746593","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746593"},{"reference_url":"https://security.gentoo.org/glsa/201406-18","reference_id":"GLSA-201406-18","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201406-18"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/213855?format=json","purl":"pkg:deb/debian/rxvt-unicode@9.15-2%2Bdeb7u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-8fw6-kn6y-nucp"},{"vulnerability":"VCID-dgmw-f5yj-63ge"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/rxvt-unicode@9.15-2%252Bdeb7u1"},{"url":"http://public2.vulnerablecode.io/api/packages/642479?format=json","purl":"pkg:deb/debian/rxvt-unicode@9.20-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-8fw6-kn6y-nucp"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/rxvt-unicode@9.20-1"}],"aliases":["CVE-2014-3121"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dgmw-f5yj-63ge"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/rxvt-unicode@9.07-2%252Bdeb6u1"}