VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
99398 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-89407 | redhat_vex | com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking | fixed: 2 known affected: 141 known not affected: 2109 | 2026-10-16T15:33:08+00:00 | Vulnerability · Source |
| CVE-2026-105820 | redhat_vex | vault: Vault: Privilege escalation via path traversal in ACL policy cache | under investigation: 3 | 2026-10-16T15:32:49+00:00 | Vulnerability · Source |
| CVE-2026-67567 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: HelmRelease chart applied with controller SA without GVK or namespace restriction | fixed: 24 known not affected: 1048 | 2026-10-16T15:32:34+00:00 | Vulnerability · Source |
| CVE-2026-66878 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: FetchChannelReferences honours Channel.spec.secretRef.namespace enabling cross-namespace Secret exfiltration | fixed: 24 known not affected: 1048 | 2026-10-16T15:32:33+00:00 | Vulnerability · Source |
| CVE-2026-50011 | redhat_vex | netty-codec-redis: Netty: Denial of Service via malicious Redis array header | fixed: 308 known affected: 2 known not affected: 2191 | 2026-10-16T15:32:25+00:00 | Vulnerability · Source |
| CVE-2026-48059 | redhat_vex | netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers | fixed: 341 known affected: 21 known not affected: 4131 | 2026-10-16T15:32:25+00:00 | Vulnerability · Source |
| CVE-2026-48006 | redhat_vex | netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator | fixed: 308 known affected: 2 known not affected: 2191 | 2026-10-16T15:32:20+00:00 | Vulnerability · Source |
| CVE-2026-47602 | redhat_vex | nvidia-driver: nvidia-driver: Denial of Service via untrusted pointer dereference | known not affected: 19 | 2026-10-16T15:32:18+00:00 | Vulnerability · Source |
| CVE-2026-47600 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via improperly initialized resource | known not affected: 19 | 2026-10-16T15:32:14+00:00 | Vulnerability · Source |
| CVE-2026-47601 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via improper memory access permissions in DMA-BUF import | known not affected: 19 | 2026-10-16T15:32:14+00:00 | Vulnerability · Source |
| CVE-2026-47592 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via out-of-bounds read in kernel mode layer | known not affected: 19 | 2026-10-16T15:32:12+00:00 | Vulnerability · Source |
| CVE-2026-47596 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via unpreserved memory permissions | known not affected: 19 | 2026-10-16T15:32:12+00:00 | Vulnerability · Source |
| CVE-2026-47588 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via use-after-free | known not affected: 19 | 2026-10-16T15:32:06+00:00 | Vulnerability · Source |
| CVE-2026-47583 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via type confusion in the kernel module | known not affected: 19 | 2026-10-16T15:32:03+00:00 | Vulnerability · Source |
| CVE-2026-47558 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via double-free of imported memory state | known not affected: 19 | 2026-10-16T15:32:00+00:00 | Vulnerability · Source |
| CVE-2026-47556 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via kernel-mode integer overflow | known not affected: 19 | 2026-10-16T15:31:59+00:00 | Vulnerability · Source |
| CVE-2026-47554 | redhat_vex | nvidia-driver: nvidia-driver: Data tampering via signature verification bypass under memory pressure | known not affected: 19 | 2026-10-16T15:31:56+00:00 | Vulnerability · Source |
| CVE-2026-47551 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via kernel-mode use-after-free | known not affected: 19 | 2026-10-16T15:31:55+00:00 | Vulnerability · Source |
| CVE-2026-47550 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via untrusted pointer dereference | known not affected: 19 | 2026-10-16T15:31:53+00:00 | Vulnerability · Source |
| CVE-2026-47548 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via out-of-bounds write in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:49+00:00 | Vulnerability · Source |
| CVE-2026-47545 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via kernel-mode out-of-bounds read | known not affected: 19 | 2026-10-16T15:31:47+00:00 | Vulnerability · Source |
| CVE-2026-47540 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via integer underflow in the kernel mode layer | known not affected: 19 | 2026-10-16T15:31:45+00:00 | Vulnerability · Source |
| CVE-2026-47530 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via out-of-bounds write in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:43+00:00 | Vulnerability · Source |
| CVE-2026-47513 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via kernel heap out-of-bounds read | known not affected: 19 | 2026-10-16T15:31:41+00:00 | Vulnerability · Source |
| CVE-2026-47510 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via integer overflow in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:38+00:00 | Vulnerability · Source |
| CVE-2026-47507 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via out-of-bounds array access in the kernel mode layer | known not affected: 19 | 2026-10-16T15:31:35+00:00 | Vulnerability · Source |
| CVE-2026-47505 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via use-after-free in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:32+00:00 | Vulnerability · Source |
| CVE-2026-46340 | redhat_vex | netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments | fixed: 308 known affected: 2 known not affected: 2192 | 2026-10-16T15:31:28+00:00 | Vulnerability · Source |
| CVE-2026-44893 | redhat_vex | netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message | fixed: 341 known affected: 19 known not affected: 4132 | 2026-10-16T15:31:27+00:00 | Vulnerability · Source |
| CVE-2026-44890 | redhat_vex | netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads | fixed: 308 known affected: 1 known not affected: 2192 | 2026-10-16T15:31:25+00:00 | Vulnerability · Source |
| CVE-2026-78667 | redhat_vex | net/http: golang: golang: Denial of Service via crafted HTTP Range headers | known affected: 296 known not affected: 46 | 2026-10-16T15:31:19+00:00 | Vulnerability · Source |
| CVE-2026-78669 | redhat_vex | net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | known affected: 284 known not affected: 65 | 2026-10-16T15:31:18+00:00 | Vulnerability · Source |
| CVE-2026-76139 | redhat_vex | acm-operator-bundle: acm-operator-bundle: Bundle build execs unpinned stolostron/release@master with full build credentials | fixed: 6 | 2026-10-16T15:31:08+00:00 | Vulnerability · Source |
| CVE-2026-75569 | redhat_vex | mce-operator-bundle: All GitHub Actions pinned by mutable tag, not commit SHA | fixed: 6 | 2026-10-16T15:31:04+00:00 | Vulnerability · Source |
| CVE-2026-73269 | redhat_vex | cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA | fixed: 24 known not affected: 704 | 2026-10-16T15:31:01+00:00 | Vulnerability · Source |
| CVE-2026-73268 | redhat_vex | cluster-curator-controller: cluster-curator-controller: spec.install.overrideJob allows arbitrary Job spec injection | fixed: 24 known not affected: 704 | 2026-10-16T15:30:57+00:00 | Vulnerability · Source |
| CVE-2026-73267 | redhat_vex | clusterclaims-controller: ManagedCluster deletion keyed solely on ClusterClaim.Spec.Namespace with no local ownership check | fixed: 24 known not affected: 704 | 2026-10-16T15:30:53+00:00 | Vulnerability · Source |
| CVE-2026-73266 | redhat_vex | clusterclaims-controller: Confused deputy: tenant-controlled ClusterClaim labels propagated to ManagedCluster, enabling cross-tenant ManagedClusterSet join | fixed: 24 known not affected: 704 | 2026-10-16T15:30:46+00:00 | Vulnerability · Source |
| CVE-2026-73137 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace Secret exfiltration via HelmRelease.repo.secretRef.namespace | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:44+00:00 | Vulnerability · Source |
| CVE-2026-73122 | redhat_vex | multicloud-operators-channel: multicloud-operators-channel: auto-generated Role grants every managed-cluster agent secrets:get,list,watch in Channel namespaces | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:39+00:00 | Vulnerability · Source |
| CVE-2026-72526 | redhat_vex | multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:33+00:00 | Vulnerability · Source |
| CVE-2026-72508 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke ServiceAccounts bound to wildcard RBAC (*/*/*) | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:29+00:00 | Vulnerability · Source |
| CVE-2026-71472 | redhat_vex | acm-search-v2-rhel9: search-v2-operator: Shell-command and SQL injection in postgresql-start.sh via CR-supplied WORK_MEM | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:22+00:00 | Vulnerability · Source |
| CVE-2026-71471 | redhat_vex | acm-search-v2-rhel9: search-v2-operator: Hub Search CR Collector.ImageOverride propagated to every spoke as arbitrary container image | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:18+00:00 | Vulnerability · Source |
| CVE-2026-71470 | redhat_vex | acm-search-v2-rhel9: search-v2-operator: Search CR imageOverride/arguments/envVar flow unsanitized into pods running impersonating SA | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:16+00:00 | Vulnerability · Source |
| CVE-2026-71469 | redhat_vex | acm-search-v2-api-rhel9: search-v2-api: Unbounded tokenReviews cache allows unauthenticated memory-exhaustion DoS | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:10+00:00 | Vulnerability · Source |
| CVE-2026-70496 | redhat_vex | search-v2-operator: search-v2-operator: operator ClusterRole is cluster-admin equivalent via impersonate, RBAC write, CSR approve, and ManifestWork | fixed: 28 known not affected: 1045 | 2026-10-16T15:30:04+00:00 | Vulnerability · Source |
| CVE-2026-70495 | redhat_vex | search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters | fixed: 24 known affected: 1 known not affected: 1048 | 2026-10-16T15:29:59+00:00 | Vulnerability · Source |
| CVE-2026-70398 | redhat_vex | multicloud-integrations: multicloud-integrations: GitOpsCluster.spec.argoServer.argoNamespace writes spoke bearer tokens to attacker-chosen namespace | fixed: 24 known not affected: 1048 | 2026-10-16T15:29:56+00:00 | Vulnerability · Source |
| CVE-2026-94627 | redhat_vex | vllm: vLLM: Denial of Service via GPU memory exhaustion | known affected: 22 known not affected: 5 | 2026-10-16T15:29:46+00:00 | Vulnerability · Source |