VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
100512 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2024-45812 | redhat_vex | vite: XSS via DOM Clobbering gadget found in vite bundled scripts | fixed: 8 known affected: 2 known not affected: 65 | 2026-10-16T17:37:00+00:00 | Vulnerability · Source |
| CVE-2024-45811 | redhat_vex | vite: server.fs.deny is bypassed when using `?import&raw` | fixed: 8 known affected: 2 known not affected: 65 | 2026-10-16T17:36:58+00:00 | Vulnerability · Source |
| CVE-2026-35536 | redhat_vex | tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments | fixed: 198 known affected: 11 known not affected: 607 | 2026-10-16T17:35:08+00:00 | Vulnerability · Source |
| CVE-2026-18611 | redhat_vex | data-science-pipelines-operator: DSPO: Cryptographically weak secret generation (math/rand) for DB and S3 credentials | fixed: 19 known not affected: 831 | 2026-10-16T17:35:04+00:00 | Vulnerability · Source |
| CVE-2026-93492 | redhat_vex | io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size | fixed: 3 known affected: 9 known not affected: 2 | 2026-10-16T17:35:02+00:00 | Vulnerability · Source |
| CVE-2026-93579 | redhat_vex | io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) | fixed: 3 known affected: 9 known not affected: 2 | 2026-10-16T17:34:57+00:00 | Vulnerability · Source |
| CVE-2026-31411 | redhat_vex | kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() | fixed: 1420 known affected: 50 known not affected: 77 | 2026-10-16T17:34:42+00:00 | Vulnerability · Source |
| CVE-2026-68086 | redhat_vex | kernel: mm/khugepaged: write all dirty file folios when collapsing | fixed: 919 known affected: 70 known not affected: 42 | 2026-10-16T17:34:35+00:00 | Vulnerability · Source |
| CVE-2026-64490 | redhat_vex | kernel: ALSA: virtio: Validate control metadata from the device | fixed: 919 known affected: 22 known not affected: 90 | 2026-10-16T17:34:33+00:00 | Vulnerability · Source |
| CVE-2026-63984 | redhat_vex | kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() | fixed: 1148 known affected: 113 known not affected: 76 | 2026-10-16T17:34:29+00:00 | Vulnerability · Source |
| CVE-2026-63920 | redhat_vex | kernel: ipv6: validate extension header length before copying to cmsg | fixed: 1298 known affected: 141 | 2026-10-16T17:34:25+00:00 | Vulnerability · Source |
| CVE-2026-46149 | redhat_vex | kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() | fixed: 1119 known affected: 64 | 2026-10-16T17:34:23+00:00 | Vulnerability · Source |
| CVE-2026-43450 | redhat_vex | kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() | fixed: 1069 known affected: 28 known not affected: 36 | 2026-10-16T17:34:18+00:00 | Vulnerability · Source |
| CVE-2026-43020 | redhat_vex | kernel: Bluetooth: MGMT: validate LTK enc_size on load | fixed: 1141 known affected: 50 known not affected: 14 | 2026-10-16T17:34:14+00:00 | Vulnerability · Source |
| CVE-2026-31772 | redhat_vex | kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync | fixed: 919 known affected: 22 known not affected: 90 | 2026-10-16T17:34:13+00:00 | Vulnerability · Source |
| CVE-2025-22870 | redhat_vex | golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | fixed: 329 known affected: 606 known not affected: 105 | 2026-10-16T17:29:43+00:00 | Vulnerability · Source |
| CVE-2025-22866 | redhat_vex | crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec | fixed: 863 known affected: 376 known not affected: 1158 | 2026-10-16T17:29:42+00:00 | Vulnerability · Source |
| CVE-2024-9266 | redhat_vex | express: URL redirection vulnerability | known affected: 56 known not affected: 64 | 2026-10-16T17:29:39+00:00 | Vulnerability · Source |
| CVE-2024-7246 | redhat_vex | grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend | fixed: 46 known affected: 1 known not affected: 4663 | 2026-10-16T17:29:38+00:00 | Vulnerability · Source |
| CVE-2025-9230 | redhat_vex | openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap | fixed: 2512 known affected: 19 known not affected: 534 | 2026-10-16T17:29:15+00:00 | Vulnerability · Source |
| CVE-2026-66804 | redhat_vex | console: Authenticated SSRF via user-controlled towerHost in /ansibletower handler | fixed: 48 known not affected: 1752 | 2026-10-16T17:26:04+00:00 | Vulnerability · Source |
| CVE-2026-66783 | redhat_vex | submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch ref | fixed: 8 known affected: 2 known not affected: 25 | 2026-10-16T17:26:03+00:00 | Vulnerability · Source |
| CVE-2026-66782 | redhat_vex | submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps | fixed: 8 known affected: 2 known not affected: 25 | 2026-10-16T17:25:55+00:00 | Vulnerability · Source |
| CVE-2026-57516 | redhat_vex | ray: Ray: Remote code execution via unsafe deserialization in WebDataset reader | fixed: 10 known affected: 14 known not affected: 7 | 2026-10-16T17:25:52+00:00 | Vulnerability · Source |
| CVE-2026-47242 | redhat_vex | net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation | fixed: 1138 known not affected: 9 | 2026-10-16T17:25:46+00:00 | Vulnerability · Source |
| CVE-2026-50811 | redhat_vex | freetype: FreeType: Out-of-bounds read vulnerability in font processing | fixed: 7 | 2026-10-16T17:25:46+00:00 | Vulnerability · Source |
| CVE-2026-4944 | redhat_vex | vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories | known affected: 10 known not affected: 16 | 2026-10-16T17:25:43+00:00 | Vulnerability · Source |
| CVE-2026-33938 | redhat_vex | handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite | fixed: 16 known affected: 15 known not affected: 180 | 2026-10-16T17:25:36+00:00 | Vulnerability · Source |
| CVE-2026-33937 | redhat_vex | handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile() | fixed: 16 known affected: 21 known not affected: 174 | 2026-10-16T17:25:32+00:00 | Vulnerability · Source |
| CVE-2026-15416 | redhat_vex | argo-cd: Argo CD unauthenticated remote code execution in repo-server via GenerateManifest gRPC endpoint | fixed: 8 known affected: 5 known not affected: 42 | 2026-10-16T17:25:31+00:00 | Vulnerability · Source |
| CVE-2026-93567 | redhat_vex | io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority | fixed: 4 known affected: 10 known not affected: 1644 | 2026-10-16T17:24:54+00:00 | Vulnerability · Source |
| CVE-2026-93569 | redhat_vex | io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority | fixed: 4 known affected: 10 known not affected: 1644 | 2026-10-16T17:24:49+00:00 | Vulnerability · Source |
| CVE-2026-93568 | redhat_vex | io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests | fixed: 4 known affected: 10 known not affected: 1644 | 2026-10-16T17:24:45+00:00 | Vulnerability · Source |
| CVE-2026-97031 | redhat_vex | crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | known affected: 271 known not affected: 81 | 2026-10-16T17:24:39+00:00 | Vulnerability · Source |
| CVE-2023-39322 | redhat_vex | golang: crypto/tls: lack of a limit on buffered post-handshake | fixed: 1187 known affected: 69 known not affected: 1276 | 2026-10-16T17:20:16+00:00 | Vulnerability · Source |
| CVE-2023-37788 | redhat_vex | goproxy: Denial of service (DoS) via unspecified vectors. | fixed: 392 known affected: 132 known not affected: 4133 | 2026-10-16T17:20:08+00:00 | Vulnerability · Source |
| CVE-2023-26159 | redhat_vex | follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() | fixed: 165 known affected: 29 known not affected: 1365 | 2026-10-16T17:19:55+00:00 | Vulnerability · Source |
| CVE-2023-26136 | redhat_vex | tough-cookie: prototype pollution in cookie memstore | fixed: 383 known affected: 44 known not affected: 3506 | 2026-10-16T17:19:45+00:00 | Vulnerability · Source |
| CVE-2023-25173 | redhat_vex | containerd: Supplementary groups are not set up properly | fixed: 477 known affected: 114 known not affected: 2344 | 2026-10-16T17:19:42+00:00 | Vulnerability · Source |
| CVE-2022-36087 | redhat_vex | python-oauthlib: DoS when attacker provides malicious IPV6 URI | fixed: 187 known affected: 10 known not affected: 14 | 2026-10-16T17:19:30+00:00 | Vulnerability · Source |
| CVE-2022-24769 | redhat_vex | moby: Default inheritable capabilities for linux container should be empty | fixed: 34 known affected: 30 known not affected: 1170 | 2026-10-16T17:19:20+00:00 | Vulnerability · Source |
| CVE-2022-21698 | redhat_vex | prometheus/client_golang: Denial of service using InstrumentHandlerCounter | fixed: 1323 known affected: 219 known not affected: 5260 under investigation: 75 | 2026-10-16T17:19:12+00:00 | Vulnerability · Source |
| CVE-2022-1941 | redhat_vex | protobuf: message parsing vulnerability in ProtocolBuffers | fixed: 67 known not affected: 105 | 2026-10-16T17:19:12+00:00 | Vulnerability · Source |
| CVE-2021-41092 | redhat_vex | docker: cli leaks private registry credentials to registry-1.docker.io | known affected: 1 known not affected: 20 | 2026-10-16T17:19:08+00:00 | Vulnerability · Source |
| CVE-2021-4235 | redhat_vex | go-yaml: Denial of Service in go-yaml | fixed: 40 known affected: 60 known not affected: 3265 | 2026-10-16T17:19:07+00:00 | Vulnerability · Source |
| CVE-2026-48937 | redhat_vex | nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame | fixed: 316 known affected: 6 known not affected: 5 | 2026-10-16T17:15:19+00:00 | Vulnerability · Source |
| CVE-2021-32760 | redhat_vex | containerd: pulling and extracting crafted container image may result in Unix file permission changes | fixed: 37 known affected: 4 known not affected: 180 under investigation: 2 | 2026-10-16T17:14:48+00:00 | Vulnerability · Source |
| CVE-2020-28852 | redhat_vex | golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag | fixed: 83 known affected: 68 known not affected: 546 | 2026-10-16T17:14:36+00:00 | Vulnerability · Source |
| CVE-2020-28851 | redhat_vex | golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension | fixed: 347 known affected: 55 known not affected: 164 | 2026-10-16T17:14:29+00:00 | Vulnerability · Source |
| CVE-2020-26160 | redhat_vex | jwt-go: access restriction bypass vulnerability | fixed: 44 known affected: 86 known not affected: 816 | 2026-10-16T17:14:19+00:00 | Vulnerability · Source |