VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
99398 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-106570 | suse_vex | SUSE CVE CVE-2026-106570 | known affected: 396 known not affected: 8 recommended: 63 | 2026-10-16T16:27:18+00:00 | Vulnerability · Source |
| CVE-2026-106571 | suse_vex | SUSE CVE CVE-2026-106571 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:27:16+00:00 | Vulnerability · Source |
| CVE-2026-106572 | suse_vex | SUSE CVE CVE-2026-106572 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:27:14+00:00 | Vulnerability · Source |
| CVE-2026-106573 | suse_vex | SUSE CVE CVE-2026-106573 | known affected: 396 known not affected: 8 recommended: 63 | 2026-10-16T16:27:12+00:00 | Vulnerability · Source |
| CVE-2026-106574 | suse_vex | SUSE CVE CVE-2026-106574 | known affected: 396 known not affected: 8 recommended: 63 | 2026-10-16T16:27:10+00:00 | Vulnerability · Source |
| CVE-2026-106575 | suse_vex | SUSE CVE CVE-2026-106575 | known affected: 396 known not affected: 8 recommended: 63 | 2026-10-16T16:27:09+00:00 | Vulnerability · Source |
| CVE-2026-106576 | suse_vex | SUSE CVE CVE-2026-106576 | known affected: 369 known not affected: 8 recommended: 63 | 2026-10-16T16:27:07+00:00 | Vulnerability · Source |
| CVE-2026-106577 | suse_vex | SUSE CVE CVE-2026-106577 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:27:05+00:00 | Vulnerability · Source |
| CVE-2026-106578 | suse_vex | SUSE CVE CVE-2026-106578 | known affected: 396 known not affected: 8 recommended: 63 | 2026-10-16T16:27:03+00:00 | Vulnerability · Source |
| CVE-2026-106579 | suse_vex | SUSE CVE CVE-2026-106579 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:27:01+00:00 | Vulnerability · Source |
| CVE-2026-107208 | suse_vex | SUSE CVE CVE-2026-107208 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:26:58+00:00 | Vulnerability · Source |
| CVE-2026-107209 | suse_vex | SUSE CVE CVE-2026-107209 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:26:55+00:00 | Vulnerability · Source |
| CVE-2026-107210 | suse_vex | SUSE CVE CVE-2026-107210 | known affected: 404 known not affected: 8 recommended: 63 | 2026-10-16T16:26:54+00:00 | Vulnerability · Source |
| CVE-2026-39821 | redhat_vex | golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing | fixed: 2121 known affected: 154 known not affected: 8239 | 2026-10-16T16:06:41+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1360 known affected: 244 known not affected: 8645 | 2026-10-16T16:06:32+00:00 | Vulnerability · Source |
| CVE-2024-34158 | redhat_vex | go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion | fixed: 4783 known affected: 62 known not affected: 2271 | 2026-10-16T16:06:25+00:00 | Vulnerability · Source |
| CVE-2024-37371 | redhat_vex | krb5: GSS message token handling | fixed: 1014 known affected: 10 known not affected: 66 | 2026-10-16T16:06:25+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 11236 known affected: 416 known not affected: 17495 | 2026-10-16T16:06:25+00:00 | Vulnerability · Source |
| CVE-2024-45336 | redhat_vex | golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect | fixed: 977 known affected: 500 known not affected: 973 | 2026-10-16T16:06:25+00:00 | Vulnerability · Source |
| CVE-2026-9673 | redhat_vex | json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via `preventCsvInjection` bypass. | fixed: 2 known not affected: 7 | 2026-10-16T16:00:58+00:00 | Vulnerability · Source |
| CVE-2026-89778 | redhat_vex | kernel: isofs: fix out-of-bounds page array access on empty zisofs block | known affected: 77 known not affected: 200 | 2026-10-16T15:41:58+00:00 | Vulnerability · Source |
| CVE-2026-70622 | redhat_vex | tar: tar-rs: Information Disclosure via Symlink Escape | known affected: 141 known not affected: 9 | 2026-10-16T15:38:19+00:00 | Vulnerability · Source |
| CVE-2026-18874 | redhat_vex | volsync-addon-controller: volsync-addon-controller: annotation values rendered into YAML via text/template without escaping allows YAML injection into Subscription | fixed: 24 known not affected: 1048 | 2026-10-16T15:37:09+00:00 | Vulnerability · Source |
| CVE-2026-18618 | redhat_vex | ml-metdata: Bundled gRPC 1.46.3 (2022) with published HTTP/2 DoS CVEs — directly reachable on listener | fixed: 13 known not affected: 307 | 2026-10-16T15:37:06+00:00 | Vulnerability · Source |
| CVE-2026-12542 | redhat_vex | foreman: command injection in foreman-tail | fixed: 103 known affected: 17 known not affected: 222 | 2026-10-16T15:37:04+00:00 | Vulnerability · Source |
| CVE-2026-64927 | redhat_vex | multicloud-operators-channel: multicloud-operators-channel: cross-namespace Secret and ConfigMap mutation via spec.secretRef.namespace confused deputy | fixed: 24 known not affected: 1048 | 2026-10-16T15:36:42+00:00 | Vulnerability · Source |
| CVE-2026-63374 | redhat_vex | anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding | fixed: 5 known affected: 100 known not affected: 92 | 2026-10-16T15:36:38+00:00 | Vulnerability · Source |
| CVE-2026-47582 | redhat_vex | nvidia-driver: nvidia-driver: Code execution via out-of-bounds write in kernel module | known not affected: 19 | 2026-10-16T15:36:37+00:00 | Vulnerability · Source |
| CVE-2026-47579 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via use-after-free in kernel mode driver | known not affected: 19 | 2026-10-16T15:36:34+00:00 | Vulnerability · Source |
| CVE-2026-76827 | redhat_vex | search-indexer: search-indexer: UPDATE/DELETE operations not scoped to caller's cluster (cross-tenant data tampering) | fixed: 24 known not affected: 1048 | 2026-10-16T15:35:59+00:00 | Vulnerability · Source |
| CVE-2026-75485 | redhat_vex | must-gather: /tmp/kubeconfig retention | fixed: 24 known not affected: 1048 | 2026-10-16T15:35:47+00:00 | Vulnerability · Source |
| CVE-2026-73834 | redhat_vex | must-gather: must-gather: embedded Secret data in ACM wrapper CRs collected without redaction | fixed: 24 known not affected: 1048 | 2026-10-16T15:35:39+00:00 | Vulnerability · Source |
| CVE-2026-71468 | redhat_vex | acm-search-v2-api-rhel9: search-v2-api: Cross-user bearer-token reuse via global federation-config cache | fixed: 24 known not affected: 1048 | 2026-10-16T15:35:28+00:00 | Vulnerability · Source |
| CVE-2026-44250 | redhat_vex | netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays | fixed: 308 known affected: 1 known not affected: 2192 | 2026-10-16T15:34:43+00:00 | Vulnerability · Source |
| CVE-2026-42504 | redhat_vex | mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header | fixed: 4955 known affected: 79 known not affected: 6629 | 2026-10-16T15:34:38+00:00 | Vulnerability · Source |
| CVE-2026-18949 | redhat_vex | odh-dashboard: odh-dashboard: ClusterRole grants cluster-wide CRUD on secrets and RBAC management resources | fixed: 12 known affected: 7 known not affected: 304 | 2026-10-16T15:34:16+00:00 | Vulnerability · Source |
| CVE-2026-18941 | redhat_vex | feast: feast-operator: Feast: Default authentication mode is no_auth — shared multi-tenant instances deployed without authentication | fixed: 9 known affected: 3 known not affected: 317 | 2026-10-16T15:34:14+00:00 | Vulnerability · Source |
| CVE-2026-18621 | redhat_vex | data-sciences-pipeline: DSP: V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening | fixed: 15 known not affected: 844 | 2026-10-16T15:34:11+00:00 | Vulnerability · Source |
| CVE-2026-18617 | redhat_vex | data-science-pipelines-operator: DSPO: MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod | fixed: 19 known not affected: 831 | 2026-10-16T15:34:03+00:00 | Vulnerability · Source |
| CVE-2026-18608 | redhat_vex | data-science-pipelines-operator: DSPO: Operator ClusterRole grants pods/exec:*, kubeflow.org */*, and ClusterRole/Binding CRUD cluster-wide | fixed: 19 known not affected: 831 | 2026-10-16T15:34:00+00:00 | Vulnerability · Source |
| CVE-2026-15055 | redhat_vex | org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bc-fips: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Denial of service due to unbounded KDF cost in PKCS#8 / PBES2 decryptors | known affected: 42 known not affected: 6 | 2026-10-16T15:33:58+00:00 | Vulnerability · Source |
| CVE-2026-89965 | redhat_vex | kernel: nvdimm/btt: reject an arena whose nfree is below the lane count | known affected: 186 known not affected: 91 | 2026-10-16T15:33:25+00:00 | Vulnerability · Source |
| CVE-2026-90414 | redhat_vex | kernel: IB/isert: reject PDUs declaring more data than was received | known affected: 263 known not affected: 14 | 2026-10-16T15:33:23+00:00 | Vulnerability · Source |
| CVE-2026-89930 | redhat_vex | kernel: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter | known affected: 235 known not affected: 42 | 2026-10-16T15:33:19+00:00 | Vulnerability · Source |
| CVE-2026-89786 | redhat_vex | kernel: ext4: fix out-of-bounds read in ext4_read_inline_dir() | known affected: 263 known not affected: 14 | 2026-10-16T15:33:15+00:00 | Vulnerability · Source |
| CVE-2026-89779 | redhat_vex | kernel: fs/ntfs3: validate ef->size covers the record's name and value | known not affected: 277 | 2026-10-16T15:33:09+00:00 | Vulnerability · Source |
| CVE-2026-89407 | redhat_vex | com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking | fixed: 2 known affected: 141 known not affected: 2109 | 2026-10-16T15:33:08+00:00 | Vulnerability · Source |
| CVE-2026-105820 | redhat_vex | vault: Vault: Privilege escalation via path traversal in ACL policy cache | under investigation: 3 | 2026-10-16T15:32:49+00:00 | Vulnerability · Source |
| CVE-2026-67567 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: HelmRelease chart applied with controller SA without GVK or namespace restriction | fixed: 24 known not affected: 1048 | 2026-10-16T15:32:34+00:00 | Vulnerability · Source |
| CVE-2026-66878 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: FetchChannelReferences honours Channel.spec.secretRef.namespace enabling cross-namespace Secret exfiltration | fixed: 24 known not affected: 1048 | 2026-10-16T15:32:33+00:00 | Vulnerability · Source |