VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
104719 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-91149 | redhat_vex | cockpit: Cockpit: Denial of Service via unbounded connection thread spawning | known affected: 32 known not affected: 3 | 2026-10-16T12:17:21+00:00 | Vulnerability · Source |
| CVE-2026-91006 | redhat_vex | org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance options | known not affected: 1 | 2026-10-16T12:17:17+00:00 | Vulnerability · Source |
| CVE-2026-88920 | redhat_vex | org.apache.wss4j/wss4j-ws-security-dom: Apache WSS4J: Authentication bypass via unsigned SAML sender-vouches assertion | known affected: 8 known not affected: 2 | 2026-10-16T12:17:11+00:00 | Vulnerability · Source |
| CVE-2026-85719 | redhat_vex | AsyncHttpClient: AsyncHttpClient: SOCKS proxy credentials exposed to origin server | known not affected: 1 | 2026-10-16T12:17:02+00:00 | Vulnerability · Source |
| CVE-2026-47504 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via type confusion in the NGX updater | known not affected: 19 | 2026-10-16T12:16:33+00:00 | Vulnerability · Source |
| CVE-2026-47500 | redhat_vex | nvidia-driver: nvidia-driver: arbitrary code execution via use-after-free in kernel mode layer | known not affected: 19 | 2026-10-16T12:16:28+00:00 | Vulnerability · Source |
| CVE-2026-47494 | redhat_vex | nvidia-driver: nvidia-driver: Arbitrary code execution via format string flaw | known not affected: 19 | 2026-10-16T12:16:25+00:00 | Vulnerability · Source |
| CVE-2026-14362 | redhat_vex | github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling | fixed: 48 known affected: 11 known not affected: 4984 | 2026-10-16T12:16:14+00:00 | Vulnerability · Source |
| CVE-2026-8723 | redhat_vex | qs: qs: Denial of Service due to improper handling of null/undefined array elements | fixed: 76 known affected: 180 known not affected: 30 | 2026-10-16T12:16:05+00:00 | Vulnerability · Source |
| CVE-2026-8632 | redhat_vex | HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection | fixed: 48 known affected: 13 known not affected: 333 | 2026-10-16T12:16:05+00:00 | Vulnerability · Source |
| CVE-2026-97791 | redhat_vex | org.apache.cxf/cxf-rt-ws-security: Apache CXF: Authentication bypass via shared token validation state | known affected: 9 known not affected: 1 | 2026-10-16T12:10:08+00:00 | Vulnerability · Source |
| CVE-2026-97468 | redhat_vex | org.apache.cxf/cxf-rt-ws-security: org.apache.cxf/cxf-services-sts-core: Apache CXF: Authentication bypass via hash collision in token cache | known affected: 9 known not affected: 1 | 2026-10-16T12:10:01+00:00 | Vulnerability · Source |
| CVE-2026-71465 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Ad-hoc command limit field allows CLI argument injection into ansible executable | fixed: 18 known not affected: 407 | 2026-10-16T12:01:18+00:00 | Vulnerability · Source |
| CVE-2026-71464 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Schedule and WorkflowJobTemplateNode scm_branch prompt bypasses leading-dash git-argument guard | fixed: 18 known not affected: 407 | 2026-10-16T12:01:16+00:00 | Vulnerability · Source |
| CVE-2026-71463 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Notification template Jinja whitelist bypass via conditional gating leaks tracebacks | fixed: 18 known not affected: 407 | 2026-10-16T12:01:16+00:00 | Vulnerability · Source |
| CVE-2026-63632 | redhat_vex | onnx: ONNX: Denial of Service via out-of-bounds read in version converter | known affected: 16 known not affected: 1 | 2026-10-16T12:01:12+00:00 | Vulnerability · Source |
| CVE-2026-107314 | redhat_vex | org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via requireAuth restriction bypass | known affected: 12 known not affected: 57 | 2026-10-16T11:55:30+00:00 | Vulnerability · Source |
| CVE-2026-85063 | redhat_vex | csv-parse: node-csv: Prototype pollution via malicious CSV header | known affected: 3 known not affected: 3 | 2026-10-16T11:55:29+00:00 | Vulnerability · Source |
| CVE-2026-84724 | redhat_vex | automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process | fixed: 18 known not affected: 407 | 2026-10-16T11:55:24+00:00 | Vulnerability · Source |
| CVE-2026-84721 | redhat_vex | automation-controller: automation-controller: Email notification backend allows SSRF via user-controlled SMTP host/port (internal port-scan oracle, SMTP password exfil) | fixed: 2 known affected: 2 known not affected: 60 | 2026-10-16T11:55:20+00:00 | Vulnerability · Source |
| CVE-2026-84720 | redhat_vex | automation-controller: automation-controller: WorkflowJobNode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via ORM-traversal count-oracle | fixed: 18 known not affected: 407 | 2026-10-16T11:55:19+00:00 | Vulnerability · Source |
| CVE-2026-84718 | redhat_vex | automation-controller: automation-controller: client IP spoofing in audit/access logs via unrestricted X-Forwarded-For trust | fixed: 18 known not affected: 407 | 2026-10-16T11:55:15+00:00 | Vulnerability · Source |
| CVE-2026-84717 | redhat_vex | automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in Bitbucket Data Center webhook receiver enumerates webhook-enabled job templates | fixed: 18 known not affected: 407 | 2026-10-16T11:55:09+00:00 | Vulnerability · Source |
| CVE-2026-84716 | redhat_vex | automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-CA certificates for caller-chosen (and case-variant impersonating) hostnames | fixed: 18 known not affected: 407 | 2026-10-16T11:55:08+00:00 | Vulnerability · Source |
| CVE-2026-84713 | redhat_vex | automation-controller: automation-controller: Notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle | fixed: 2 known affected: 2 known not affected: 60 | 2026-10-16T11:55:06+00:00 | Vulnerability · Source |
| CVE-2026-84712 | redhat_vex | automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership | fixed: 18 known not affected: 407 | 2026-10-16T11:55:04+00:00 | Vulnerability · Source |
| CVE-2026-84499 | redhat_vex | automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via Schedule/WorkflowJobTemplateNode survey min/max validation error message | fixed: 18 known not affected: 407 | 2026-10-16T11:54:46+00:00 | Vulnerability · Source |
| CVE-2026-83530 | redhat_vex | github.com/cel-expr/cel-go: cel-go: Denial of Service via uncontrolled memory allocation | known affected: 1 | 2026-10-16T11:54:43+00:00 | Vulnerability · Source |
| CVE-2026-81176 | redhat_vex | devalue: Devalue: Denial of Service via malformed input parsing | known affected: 3 | 2026-10-16T11:54:39+00:00 | Vulnerability · Source |
| CVE-2026-80185 | redhat_vex | bluez: sdp-xml: BlueZ 5.86: unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root | known affected: 24 known not affected: 8 | 2026-10-16T11:54:37+00:00 | Vulnerability · Source |
| CVE-2026-80158 | redhat_vex | ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the IPA bind password in logs and process listings | known affected: 5 | 2026-10-16T11:54:35+00:00 | Vulnerability · Source |
| CVE-2026-77387 | redhat_vex | geopy: geopy: Denial of Service via inefficient regular expression coordinate parsing | known affected: 9 | 2026-10-16T11:54:34+00:00 | Vulnerability · Source |
| CVE-2026-78684 | redhat_vex | vllm: vLLM: Denial of Service via DeepStream backend resource control bypass. | known affected: 27 | 2026-10-16T11:54:33+00:00 | Vulnerability · Source |
| CVE-2026-76925 | redhat_vex | flatpak: Flatpak: TOCTOU race condition allows symlink redirection | known affected: 23 | 2026-10-16T11:54:27+00:00 | Vulnerability · Source |
| CVE-2026-75509 | redhat_vex | joserfc: joserfc: Issuer-validation bypass via array-valued claims | known affected: 8 known not affected: 1 | 2026-10-16T11:54:23+00:00 | Vulnerability · Source |
| CVE-2026-73621 | redhat_vex | gitpython: GitPython: Arbitrary File Truncation via Commit.count() Argument Injection | known affected: 56 | 2026-10-16T11:54:19+00:00 | Vulnerability · Source |
| CVE-2026-73560 | redhat_vex | vllm: vLLM: Server-Side Request Forgery and arbitrary file read via improper media processing | fixed: 8 known affected: 22 | 2026-10-16T11:54:16+00:00 | Vulnerability · Source |
| CVE-2026-71486 | redhat_vex | vllm: vLLM: Denial of Service via unbounded token ID decoding | fixed: 8 known affected: 22 | 2026-10-16T11:54:13+00:00 | Vulnerability · Source |
| CVE-2026-71462 | redhat_vex | automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on control pod | fixed: 18 known not affected: 407 | 2026-10-16T11:54:09+00:00 | Vulnerability · Source |
| CVE-2026-71461 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Verbose internal exception disclosure via HostList bare-Exception handler | fixed: 2 known affected: 2 known not affected: 60 | 2026-10-16T11:54:06+00:00 | Vulnerability · Source |
| CVE-2026-71460 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/ | fixed: 18 known not affected: 407 | 2026-10-16T11:54:03+00:00 | Vulnerability · Source |
| CVE-2026-71459 | redhat_vex | automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure | fixed: 18 known not affected: 407 | 2026-10-16T11:54:00+00:00 | Vulnerability · Source |
| CVE-2026-71429 | redhat_vex | stream-json: stream-json: Denial of Service due to inefficient processing of deeply nested JSON | known affected: 1 | 2026-10-16T11:53:57+00:00 | Vulnerability · Source |
| CVE-2026-71458 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration | fixed: 18 known not affected: 407 | 2026-10-16T11:53:57+00:00 | Vulnerability · Source |
| CVE-2026-69147 | redhat_vex | vllm: vLLM: GPU memory exhaustion via PyNvVideoCodec decode bypass | fixed: 8 known affected: 22 | 2026-10-16T11:53:51+00:00 | Vulnerability · Source |
| CVE-2026-68079 | redhat_vex | org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider | fixed: 1 known affected: 1 | 2026-10-16T11:53:49+00:00 | Vulnerability · Source |
| CVE-2026-64643 | redhat_vex | next: Next.js: Information disclosure via Server Action ID exposure | known affected: 22 | 2026-10-16T11:53:42+00:00 | Vulnerability · Source |
| CVE-2026-63349 | redhat_vex | anyio: AnyIO: Privilege retention in child processes due to incorrect group handling | known affected: 127 known not affected: 5 | 2026-10-16T11:53:39+00:00 | Vulnerability · Source |
| CVE-2026-63317 | redhat_vex | org.apache.opennlp/opennlp-tools: Apache OpenNLP: Arbitrary class instantiation via crafted XML or untrusted format names | known affected: 5 | 2026-10-16T11:53:37+00:00 | Vulnerability · Source |
| CVE-2026-62380 | redhat_vex | io.netty/netty-codec-socks: Netty: Null byte and CRLF injection in SOCKS client encoders can lead to domain spoofing | known affected: 49 | 2026-10-16T11:53:35+00:00 | Vulnerability · Source |