VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
100518 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-47556 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via kernel-mode integer overflow | known not affected: 19 | 2026-10-16T15:31:59+00:00 | Vulnerability · Source |
| CVE-2026-47554 | redhat_vex | nvidia-driver: nvidia-driver: Data tampering via signature verification bypass under memory pressure | known not affected: 19 | 2026-10-16T15:31:56+00:00 | Vulnerability · Source |
| CVE-2026-47551 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via kernel-mode use-after-free | known not affected: 19 | 2026-10-16T15:31:55+00:00 | Vulnerability · Source |
| CVE-2026-47550 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via untrusted pointer dereference | known not affected: 19 | 2026-10-16T15:31:53+00:00 | Vulnerability · Source |
| CVE-2026-47548 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via out-of-bounds write in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:49+00:00 | Vulnerability · Source |
| CVE-2026-47545 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via kernel-mode out-of-bounds read | known not affected: 19 | 2026-10-16T15:31:47+00:00 | Vulnerability · Source |
| CVE-2026-47540 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via integer underflow in the kernel mode layer | known not affected: 19 | 2026-10-16T15:31:45+00:00 | Vulnerability · Source |
| CVE-2026-47530 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via out-of-bounds write in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:43+00:00 | Vulnerability · Source |
| CVE-2026-47513 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via kernel heap out-of-bounds read | known not affected: 19 | 2026-10-16T15:31:41+00:00 | Vulnerability · Source |
| CVE-2026-47510 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via integer overflow in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:38+00:00 | Vulnerability · Source |
| CVE-2026-47507 | redhat_vex | nvidia-driver: nvidia-driver: Privilege escalation via out-of-bounds array access in the kernel mode layer | known not affected: 19 | 2026-10-16T15:31:35+00:00 | Vulnerability · Source |
| CVE-2026-47505 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via use-after-free in kernel mode layer | known not affected: 19 | 2026-10-16T15:31:32+00:00 | Vulnerability · Source |
| CVE-2026-46340 | redhat_vex | netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments | fixed: 308 known affected: 2 known not affected: 2192 | 2026-10-16T15:31:28+00:00 | Vulnerability · Source |
| CVE-2026-44893 | redhat_vex | netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message | fixed: 341 known affected: 19 known not affected: 4132 | 2026-10-16T15:31:27+00:00 | Vulnerability · Source |
| CVE-2026-44890 | redhat_vex | netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads | fixed: 308 known affected: 1 known not affected: 2192 | 2026-10-16T15:31:25+00:00 | Vulnerability · Source |
| CVE-2026-78669 | redhat_vex | net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | known affected: 284 known not affected: 65 | 2026-10-16T15:31:18+00:00 | Vulnerability · Source |
| CVE-2026-76139 | redhat_vex | acm-operator-bundle: acm-operator-bundle: Bundle build execs unpinned stolostron/release@master with full build credentials | fixed: 6 | 2026-10-16T15:31:08+00:00 | Vulnerability · Source |
| CVE-2026-75569 | redhat_vex | mce-operator-bundle: All GitHub Actions pinned by mutable tag, not commit SHA | fixed: 6 | 2026-10-16T15:31:04+00:00 | Vulnerability · Source |
| CVE-2026-73269 | redhat_vex | cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA | fixed: 24 known not affected: 704 | 2026-10-16T15:31:01+00:00 | Vulnerability · Source |
| CVE-2026-73268 | redhat_vex | cluster-curator-controller: cluster-curator-controller: spec.install.overrideJob allows arbitrary Job spec injection | fixed: 24 known not affected: 704 | 2026-10-16T15:30:57+00:00 | Vulnerability · Source |
| CVE-2026-73267 | redhat_vex | clusterclaims-controller: ManagedCluster deletion keyed solely on ClusterClaim.Spec.Namespace with no local ownership check | fixed: 24 known not affected: 704 | 2026-10-16T15:30:53+00:00 | Vulnerability · Source |
| CVE-2026-73266 | redhat_vex | clusterclaims-controller: Confused deputy: tenant-controlled ClusterClaim labels propagated to ManagedCluster, enabling cross-tenant ManagedClusterSet join | fixed: 24 known not affected: 704 | 2026-10-16T15:30:46+00:00 | Vulnerability · Source |
| CVE-2026-73137 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace Secret exfiltration via HelmRelease.repo.secretRef.namespace | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:44+00:00 | Vulnerability · Source |
| CVE-2026-73122 | redhat_vex | multicloud-operators-channel: multicloud-operators-channel: auto-generated Role grants every managed-cluster agent secrets:get,list,watch in Channel namespaces | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:39+00:00 | Vulnerability · Source |
| CVE-2026-72526 | redhat_vex | multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:33+00:00 | Vulnerability · Source |
| CVE-2026-72508 | redhat_vex | multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke ServiceAccounts bound to wildcard RBAC (*/*/*) | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:29+00:00 | Vulnerability · Source |
| CVE-2026-71472 | redhat_vex | acm-search-v2-rhel9: search-v2-operator: Shell-command and SQL injection in postgresql-start.sh via CR-supplied WORK_MEM | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:22+00:00 | Vulnerability · Source |
| CVE-2026-71471 | redhat_vex | acm-search-v2-rhel9: search-v2-operator: Hub Search CR Collector.ImageOverride propagated to every spoke as arbitrary container image | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:18+00:00 | Vulnerability · Source |
| CVE-2026-71470 | redhat_vex | acm-search-v2-rhel9: search-v2-operator: Search CR imageOverride/arguments/envVar flow unsanitized into pods running impersonating SA | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:16+00:00 | Vulnerability · Source |
| CVE-2026-71469 | redhat_vex | acm-search-v2-api-rhel9: search-v2-api: Unbounded tokenReviews cache allows unauthenticated memory-exhaustion DoS | fixed: 24 known not affected: 1048 | 2026-10-16T15:30:10+00:00 | Vulnerability · Source |
| CVE-2026-70496 | redhat_vex | search-v2-operator: search-v2-operator: operator ClusterRole is cluster-admin equivalent via impersonate, RBAC write, CSR approve, and ManifestWork | fixed: 28 known not affected: 1045 | 2026-10-16T15:30:04+00:00 | Vulnerability · Source |
| CVE-2026-70495 | redhat_vex | search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters | fixed: 24 known affected: 1 known not affected: 1048 | 2026-10-16T15:29:59+00:00 | Vulnerability · Source |
| CVE-2026-70398 | redhat_vex | multicloud-integrations: multicloud-integrations: GitOpsCluster.spec.argoServer.argoNamespace writes spoke bearer tokens to attacker-chosen namespace | fixed: 24 known not affected: 1048 | 2026-10-16T15:29:56+00:00 | Vulnerability · Source |
| CVE-2026-94627 | redhat_vex | vllm: vLLM: Denial of Service via GPU memory exhaustion | known affected: 22 known not affected: 5 | 2026-10-16T15:29:46+00:00 | Vulnerability · Source |
| CVE-2026-94626 | redhat_vex | vllm: vLLM: Denial of Service via unvalidated memory allocation parameter | known affected: 22 known not affected: 5 | 2026-10-16T15:29:42+00:00 | Vulnerability · Source |
| CVE-2026-94625 | redhat_vex | vllm: vLLM: Resource exhaustion via rejected prefill requests | known affected: 22 known not affected: 5 | 2026-10-16T15:29:42+00:00 | Vulnerability · Source |
| CVE-2026-94624 | redhat_vex | vllm: vLLM: Denial of Service via unbounded P2P KV offloading sessions | known affected: 22 known not affected: 5 | 2026-10-16T15:29:38+00:00 | Vulnerability · Source |
| CVE-2026-94623 | redhat_vex | vllm: vLLM: Denial of Service via NIXL multi-prompt assertion failure | known affected: 22 known not affected: 5 | 2026-10-16T15:29:35+00:00 | Vulnerability · Source |
| CVE-2026-94622 | redhat_vex | vllm: vLLM: Denial of Service via Incomplete NIXL KV Transfer Metadata | known affected: 22 known not affected: 5 | 2026-10-16T15:29:32+00:00 | Vulnerability · Source |
| CVE-2026-93592 | redhat_vex | vllm: vLLM: Denial of Service via negative token ID input | fixed: 8 known affected: 17 known not affected: 5 | 2026-10-16T15:29:29+00:00 | Vulnerability · Source |
| CVE-2026-93436 | redhat_vex | vllm: vLLM: Denial of Service via memory exhaustion from rejected requests | known affected: 22 known not affected: 5 | 2026-10-16T15:29:23+00:00 | Vulnerability · Source |
| CVE-2026-92365 | redhat_vex | vllm: vllm-project vllm: Denial of Service via algorithmic complexity vulnerability | known affected: 22 known not affected: 5 | 2026-10-16T15:29:21+00:00 | Vulnerability · Source |
| CVE-2026-92220 | redhat_vex | vllm: vLLM: Resource consumption via argument manipulation in MoRIIO Acknowledgement Handler | known affected: 25 known not affected: 2 | 2026-10-16T15:29:20+00:00 | Vulnerability · Source |
| CVE-2026-91135 | redhat_vex | thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compression | known affected: 24 known not affected: 19 under investigation: 35 | 2026-10-16T15:29:16+00:00 | Vulnerability · Source |
| CVE-2026-90553 | redhat_vex | vllm: vLLM: Remote Code Execution via LlavaOnevision2 processor ignoring trust_remote_code | known affected: 22 known not affected: 5 | 2026-10-16T15:29:15+00:00 | Vulnerability · Source |
| CVE-2026-90011 | redhat_vex | kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload | known affected: 263 known not affected: 14 | 2026-10-16T15:29:10+00:00 | Vulnerability · Source |
| CVE-2026-89425 | redhat_vex | com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing | fixed: 2 known affected: 152 known not affected: 2104 | 2026-10-16T15:29:06+00:00 | Vulnerability · Source |
| CVE-2026-88815 | redhat_vex | perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting | fixed: 36 known affected: 4 | 2026-10-16T15:29:04+00:00 | Vulnerability · Source |
| CVE-2026-102560 | redhat_vex | libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth | fixed: 39 known affected: 9 | 2026-10-16T15:28:28+00:00 | Vulnerability · Source |
| CVE-2026-102331 | redhat_vex | chromium-browser: angle: chromium-browser: arbitrary code execution via buffer overflow in ANGLE | known affected: 27 known not affected: 18 | 2026-10-16T15:28:18+00:00 | Vulnerability · Source |