VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
104719 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-19611 | redhat_vex | wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding | fixed: 4 known affected: 10 known not affected: 1644 | 2026-10-16T11:53:12+00:00 | Vulnerability · Source |
| CVE-2026-6238 | redhat_vex | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response | fixed: 3582 known not affected: 39 | 2026-10-16T11:53:00+00:00 | Vulnerability · Source |
| CVE-2026-100790 | redhat_vex | firefox: thunderbird: Use-after-free in the XSLT component | known affected: 22 known not affected: 1 | 2026-10-16T11:52:52+00:00 | Vulnerability · Source |
| CVE-2026-100785 | redhat_vex | firefox: thunderbird: Use-after-free in the DOM: Core & HTML component | known affected: 22 known not affected: 1 | 2026-10-16T11:52:48+00:00 | Vulnerability · Source |
| CVE-2026-100766 | redhat_vex | firefox: thunderbird: Information disclosure in the Networking: JAR component | known affected: 22 known not affected: 1 | 2026-10-16T11:52:47+00:00 | Vulnerability · Source |
| CVE-2026-100769 | redhat_vex | firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component | known affected: 22 known not affected: 1 | 2026-10-16T11:52:46+00:00 | Vulnerability · Source |
| CVE-2026-100759 | redhat_vex | firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component | known affected: 22 known not affected: 1 | 2026-10-16T11:52:43+00:00 | Vulnerability · Source |
| CVE-2026-85475 | redhat_vex | automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via LOG_AGGREGATOR_* settings leads to remote code execution in the control-plane rsyslog component | fixed: 2 known affected: 2 known not affected: 60 | 2026-10-16T11:52:41+00:00 | Vulnerability · Source |
| CVE-2026-85394 | redhat_vex | jose: python-jose: python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret | known affected: 1 known not affected: 2 | 2026-10-16T11:52:38+00:00 | Vulnerability · Source |
| CVE-2026-85228 | redhat_vex | ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library | fixed: 1 known affected: 1 | 2026-10-16T11:52:36+00:00 | Vulnerability · Source |
| CVE-2026-85078 | redhat_vex | sanic: Sanic: Request smuggling via incomplete chunked-body handling | known affected: 1 | 2026-10-16T11:52:33+00:00 | Vulnerability · Source |
| CVE-2026-85077 | redhat_vex | sanic: Sanic: HTTP response header injection leading to session fixation or cache poisoning | known affected: 1 | 2026-10-16T11:52:29+00:00 | Vulnerability · Source |
| CVE-2026-84714 | redhat_vex | automation-controller: automation-controller: incomplete sanitize_jinja() regex allows Jinja template injection into ad-hoc module_args, Machine-credential fields, and Host names, reaching ansible-core templating in the execution environment | fixed: 18 known not affected: 407 | 2026-10-16T11:52:28+00:00 | Vulnerability · Source |
| CVE-2026-84706 | redhat_vex | automation-controller: automation-controller-container: automation-controller: Credential Type env-injector deny-list omits process-hijacking variables (BASH_ENV/LD_PRELOAD) allowing code execution in the execution environment | fixed: 18 known not affected: 407 | 2026-10-16T11:52:22+00:00 | Vulnerability · Source |
| CVE-2026-84691 | redhat_vex | automation-controller: automation-controller-container: automation-controller: format string injection in the API 4XX error log setting discloses Django SECRET_KEY and database credentials to an administrator | fixed: 18 known not affected: 407 | 2026-10-16T11:52:12+00:00 | Vulnerability · Source |
| CVE-2026-84683 | redhat_vex | automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout HTML view via ANSI OSC 8 hyperlink sequences (javascript: anchor) enabling session takeover | fixed: 18 known not affected: 407 | 2026-10-16T11:52:02+00:00 | Vulnerability · Source |
| CVE-2026-84486 | redhat_vex | automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (AllowAny, routed without DEBUG guard) allow advisory-lock starvation of job dispatch (DoS) | fixed: 10 known not affected: 277 | 2026-10-16T11:51:46+00:00 | Vulnerability · Source |
| CVE-2026-84372 | redhat_vex | predis/predis: Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | known not affected: 1 | 2026-10-16T11:51:40+00:00 | Vulnerability · Source |
| CVE-2026-82455 | redhat_vex | rubygems: RubyGems: Path Traversal vulnerability during gem extraction | known not affected: 126 | 2026-10-16T11:51:31+00:00 | Vulnerability · Source |
| CVE-2026-82277 | redhat_vex | argo-rollouts: argo-rollouts: Argo Rollouts Dashboard Unauthenticated Mutating Operations | fixed: 5 known affected: 3 known not affected: 25 | 2026-10-16T11:51:28+00:00 | Vulnerability · Source |
| CVE-2026-82035 | redhat_vex | pymupdf: PyMuPDF: Arbitrary file write via path traversal vulnerability | known affected: 4 | 2026-10-16T11:51:26+00:00 | Vulnerability · Source |
| CVE-2026-81642 | redhat_vex | unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY | fixed: 386 known affected: 5 known not affected: 198 | 2026-10-16T11:51:22+00:00 | Vulnerability · Source |
| CVE-2026-80186 | redhat_vex | bluez: Stack Overflow in name2utf8 causes DoS and potential code execution | known affected: 24 known not affected: 8 | 2026-10-16T11:51:19+00:00 | Vulnerability · Source |
| CVE-2026-76648 | redhat_vex | automation-controller: automation-controller-container: AAP Controller: CopyAPIView.post() missing read authorization check enables Job Template secret recovery | fixed: 2 known affected: 2 known not affected: 61 | 2026-10-16T11:51:07+00:00 | Vulnerability · Source |
| CVE-2026-75935 | redhat_vex | software.amazon.ion/ion-java: Amazon ion-java: Denial of service via uncontrolled memory allocation | known affected: 1 | 2026-10-16T11:51:02+00:00 | Vulnerability · Source |
| CVE-2026-75926 | redhat_vex | github.com/gohugoio/hugo: tailwindcss: Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant | known not affected: 1 | 2026-10-16T11:51:00+00:00 | Vulnerability · Source |
| CVE-2026-73256 | redhat_vex | mongoose: Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE | known not affected: 1 | 2026-10-16T11:50:55+00:00 | Vulnerability · Source |
| CVE-2026-73251 | redhat_vex | mongoose: Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification | known not affected: 1 | 2026-10-16T11:50:51+00:00 | Vulnerability · Source |
| CVE-2026-73030 | redhat_vex | unearth: unearth: Arbitrary file write via unnormalized paths | known not affected: 1 | 2026-10-16T11:50:46+00:00 | Vulnerability · Source |
| CVE-2026-72903 | redhat_vex | tabby: Tabby: Arbitrary file write via SFTP path traversal | known affected: 1 | 2026-10-16T11:50:42+00:00 | Vulnerability · Source |
| CVE-2026-71261 | redhat_vex | dr_libs: dr_libs: Heap buffer overflow via crafted W64 WAV file | known not affected: 1 | 2026-10-16T11:50:32+00:00 | Vulnerability · Source |
| CVE-2026-68006 | redhat_vex | puma: Puma: HTTP Request Smuggling via Underscore Header Name Confusion | known affected: 1 known not affected: 10 | 2026-10-16T11:50:12+00:00 | Vulnerability · Source |
| CVE-2026-66357 | redhat_vex | otp: inets: Erlang/OTP inets: HTTP Request Smuggling via improper header parsing | known not affected: 1 | 2026-10-16T11:50:02+00:00 | Vulnerability · Source |
| CVE-2026-43003 | redhat_vex | ironic-python-agent: OpenStack ironic-python-agent: Arbitrary code execution via malicious image | fixed: 14 known affected: 1 known not affected: 4565 | 2026-10-16T11:49:51+00:00 | Vulnerability · Source |
| CVE-2026-6951 | redhat_vex | simple-git: simple-git: Remote Code Execution due to incomplete fix bypass | known affected: 15 known not affected: 6 | 2026-10-16T11:49:36+00:00 | Vulnerability · Source |
| CVE-2026-8328 | redhat_vex | python: Python: FTP connection redirection via ftpcp() function bypass | fixed: 95 known not affected: 1 | 2026-10-16T11:49:36+00:00 | Vulnerability · Source |
| CVE-2026-59980 | redhat_vex | hpack: golang.org/x/net/http2/hpack: hpack: Denial of Service via malformed HTTP/2 header encoding | known affected: 16 known not affected: 1 | 2026-10-16T11:28:50+00:00 | Vulnerability · Source |
| CVE-2026-56857 | redhat_vex | os: golang: golang: Directory traversal via Windows junction handling | known affected: 105 known not affected: 74 | 2026-10-16T11:28:47+00:00 | Vulnerability · Source |
| CVE-2026-54280 | redhat_vex | aiohttp: AIOHTTP: Denial of Service due to improper resource handling | known affected: 4 known not affected: 112 | 2026-10-16T11:28:46+00:00 | Vulnerability · Source |
| CVE-2026-47065 | redhat_vex | mina: mina: Arbitrary Code Execution via Deserialization Bypass | fixed: 38 known affected: 2 known not affected: 59 | 2026-10-16T11:28:43+00:00 | Vulnerability · Source |
| CVE-2026-44605 | redhat_vex | rpm: heap buffer overflow in NDB slot table parsing | fixed: 41 known affected: 72 | 2026-10-16T11:28:41+00:00 | Vulnerability · Source |
| CVE-2026-18839 | redhat_vex | popt-devel: popt-static: size_t underflow in singleOptionHelp | fixed: 10 known affected: 14 | 2026-10-16T11:28:37+00:00 | Vulnerability · Source |
| CVE-2026-103001 | redhat_vex | pyjwt: pyjwt: Token validation bypass via options dictionary mutation | fixed: 8 known affected: 233 known not affected: 6 | 2026-10-16T11:24:24+00:00 | Vulnerability · Source |
| CVE-2026-61712 | redhat_vex | github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing | known affected: 147 known not affected: 52 | 2026-10-16T11:24:17+00:00 | Vulnerability · Source |
| CVE-2026-59317 | redhat_vex | org.springframework.kafka/spring-kafka: Spring for Apache Kafka: Denial of Service via missing header validation | known affected: 1 | 2026-10-16T11:24:11+00:00 | Vulnerability · Source |
| CVE-2026-58649 | redhat_vex | dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability | fixed: 1348 known not affected: 50 | 2026-10-16T11:24:06+00:00 | Vulnerability · Source |
| CVE-2026-57822 | redhat_vex | artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address | fixed: 2 known affected: 3 known not affected: 3 | 2026-10-16T11:24:03+00:00 | Vulnerability · Source |
| CVE-2026-57818 | redhat_vex | org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition | fixed: 1 known affected: 1 | 2026-10-16T11:24:01+00:00 | Vulnerability · Source |
| CVE-2026-56866 | redhat_vex | net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections | known affected: 342 | 2026-10-16T11:23:58+00:00 | Vulnerability · Source |
| CVE-2026-56411 | redhat_vex | expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution | fixed: 7 known affected: 6 | 2026-10-16T11:23:56+00:00 | Vulnerability · Source |