VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
104719 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-56403 | redhat_vex | libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts | known affected: 28 | 2026-10-16T11:23:53+00:00 | Vulnerability · Source |
| CVE-2026-56289 | redhat_vex | patch: GNU patch: Denial of Service via crafted unified-diff input | fixed: 3 | 2026-10-16T11:23:51+00:00 | Vulnerability · Source |
| CVE-2026-56288 | redhat_vex | patch: GNU patch: Denial of Service via specially crafted patch file | fixed: 3 | 2026-10-16T11:23:48+00:00 | Vulnerability · Source |
| CVE-2026-55894 | redhat_vex | capstone: Capstone: Denial of Service via crafted SH2A bytecode | fixed: 11 known affected: 11 | 2026-10-16T11:23:47+00:00 | Vulnerability · Source |
| CVE-2026-55893 | redhat_vex | capstone: Capstone: Heap buffer overflow with potential code execution | fixed: 11 known affected: 11 | 2026-10-16T11:23:43+00:00 | Vulnerability · Source |
| CVE-2026-53669 | redhat_vex | react-router: React Router: Open Redirect vulnerability via backslashes in navigation components | fixed: 6 known affected: 148 | 2026-10-16T11:23:40+00:00 | Vulnerability · Source |
| CVE-2026-50659 | redhat_vex | .NET: .NET: Network Spoofing Vulnerability | fixed: 1467 known not affected: 51 | 2026-10-16T11:23:37+00:00 | Vulnerability · Source |
| CVE-2026-48990 | redhat_vex | joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads | fixed: 11 known not affected: 200 | 2026-10-16T11:23:26+00:00 | Vulnerability · Source |
| CVE-2026-49263 | redhat_vex | capstone: Capstone: Denial of Service and parser desynchronization via WebAssembly `br_table` instruction-size truncation | fixed: 16 known affected: 11 | 2026-10-16T11:23:26+00:00 | Vulnerability · Source |
| CVE-2026-47734 | redhat_vex | dulwich: Dulwich: Denial of Service via crafted Git thin pack | known affected: 25 | 2026-10-16T11:23:20+00:00 | Vulnerability · Source |
| CVE-2026-42926 | redhat_vex | nginx: NGINX Open Source: Data injection via HTTP/2 proxy configuration | fixed: 25 known affected: 54 | 2026-10-16T11:23:19+00:00 | Vulnerability · Source |
| CVE-2026-40962 | redhat_vex | FFmpeg: FFmpeg: Integer overflow and out-of-bounds write via CENC subsample data | fixed: 139 known affected: 10 | 2026-10-16T11:23:14+00:00 | Vulnerability · Source |
| CVE-2026-40253 | redhat_vex | openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects | fixed: 473 known affected: 12 known not affected: 16 | 2026-10-16T11:23:10+00:00 | Vulnerability · Source |
| CVE-2026-35206 | redhat_vex | github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart | fixed: 16 known affected: 1 known not affected: 281 under investigation: 8 | 2026-10-16T11:23:08+00:00 | Vulnerability · Source |
| CVE-2026-33747 | redhat_vex | BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend | fixed: 271 known affected: 29 known not affected: 712 | 2026-10-16T11:23:05+00:00 | Vulnerability · Source |
| CVE-2026-33378 | redhat_vex | grafana: Grafana: Denial of Service due to Out of Memory via $__timeGroup macro | fixed: 9 known not affected: 1 | 2026-10-16T11:23:02+00:00 | Vulnerability · Source |
| CVE-2026-32637 | redhat_vex | github.com/vmware-tanzu/velero: Velero: File path traversal allows overwriting sensitive files via malicious backup tarball. | known affected: 7 known not affected: 2 | 2026-10-16T11:23:00+00:00 | Vulnerability · Source |
| CVE-2026-27837 | redhat_vex | dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass | known affected: 1 known not affected: 17 | 2026-10-16T11:22:58+00:00 | Vulnerability · Source |
| CVE-2026-19475 | redhat_vex | grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro | known affected: 10 known not affected: 20 | 2026-10-16T11:22:54+00:00 | Vulnerability · Source |
| CVE-2026-19160 | redhat_vex | chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Google Chrome | fixed: 46 known affected: 9 known not affected: 21 | 2026-10-16T11:22:51+00:00 | Vulnerability · Source |
| CVE-2026-16336 | redhat_vex | trino: Trino: Open redirect vulnerability in OAuth2/OIDC component | known not affected: 1 | 2026-10-16T11:22:50+00:00 | Vulnerability · Source |
| CVE-2026-18504 | redhat_vex | fastify: fastify: Schema validation bypass via root primitive coercion mismatch | known affected: 16 | 2026-10-16T11:22:49+00:00 | Vulnerability · Source |
| CVE-2026-12624 | redhat_vex | Vault: Vault: Information disclosure via ACL policy bypass | known affected: 3 | 2026-10-16T11:22:43+00:00 | Vulnerability · Source |
| CVE-2026-11819 | redhat_vex | community.general: community.general keyring_info — OS keyring passphrase returned in plaintext | known affected: 4 | 2026-10-16T11:22:41+00:00 | Vulnerability · Source |
| CVE-2026-78384 | redhat_vex | org.apache.cxf/cxf-core: Apache CXF: Denial of Service via uncontrolled data decompression | known affected: 10 known not affected: 1 | 2026-10-16T11:18:41+00:00 | Vulnerability · Source |
| CVE-2026-62296 | redhat_vex | ca.uhn.hapi.fhir/hapi-fhir-base: HAPI FHIR: Denial of Service via unbounded recursion in XHTML narrative parser | fixed: 1 known affected: 1 known not affected: 1 | 2026-10-16T11:18:25+00:00 | Vulnerability · Source |
| CVE-2026-61674 | redhat_vex | fluent-bit: Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler | known not affected: 1 | 2026-10-16T11:18:21+00:00 | Vulnerability · Source |
| CVE-2026-61518 | redhat_vex | ISPConfig: ISPConfig: Arbitrary SQL injection via Remote API primary_id parameter | known not affected: 1 | 2026-10-16T11:18:17+00:00 | Vulnerability · Source |
| CVE-2026-59902 | redhat_vex | io.netty/netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion | fixed: 1 known affected: 6 known not affected: 1 | 2026-10-16T11:18:15+00:00 | Vulnerability · Source |
| CVE-2026-57171 | redhat_vex | compliance-trestle: Trestle: Arbitrary file write via path traversal in author generate commands | known not affected: 2 | 2026-10-16T11:17:58+00:00 | Vulnerability · Source |
| CVE-2026-57170 | redhat_vex | compliance-trestle: Trestle: Arbitrary code execution via Server-Side Template Injection | known not affected: 2 | 2026-10-16T11:17:54+00:00 | Vulnerability · Source |
| CVE-2026-55765 | redhat_vex | github.com/cloudnative-pg/cloudnative-pg: CloudNativePG: Remote Code Execution due to cleartext role passwords in pg_stat_statements | known affected: 3 known not affected: 6 | 2026-10-16T11:17:44+00:00 | Vulnerability · Source |
| CVE-2026-54757 | redhat_vex | compliance-trestle: Trestle: Remote Code Execution via Server-Side Template Injection | known not affected: 2 | 2026-10-16T11:17:38+00:00 | Vulnerability · Source |
| CVE-2026-54451 | redhat_vex | protobuf: Elixir protobuf: Denial of Service via unbounded recursion in message decoding | known affected: 2 known not affected: 5 | 2026-10-16T11:17:34+00:00 | Vulnerability · Source |
| CVE-2026-54552 | redhat_vex | sh: sh: Incomplete privilege drop allows child processes to retain privileged group access. | known not affected: 1 | 2026-10-16T11:17:34+00:00 | Vulnerability · Source |
| CVE-2026-53713 | redhat_vex | github.com/envoyproxy/gateway: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure | known not affected: 2 | 2026-10-16T11:17:27+00:00 | Vulnerability · Source |
| CVE-2026-50237 | redhat_vex | openshift/console: Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console | fixed: 38 known not affected: 6263 | 2026-10-16T11:17:10+00:00 | Vulnerability · Source |
| CVE-2026-50236 | redhat_vex | openshift/console: Authenticated SSRF with full response reflection and path neutralization via Dev Console webhook helpers in OpenShift Console | fixed: 36 known not affected: 5884 | 2026-10-16T11:17:05+00:00 | Vulnerability · Source |
| CVE-2026-47874 | redhat_vex | io.projectreactor.netty/reactor-netty: Reactor Netty HTTP Server: Denial of Service via pipelined HTTP/1.1 requests | known not affected: 1 | 2026-10-16T11:17:00+00:00 | Vulnerability · Source |
| CVE-2026-47187 | redhat_vex | sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write | known affected: 1 | 2026-10-16T11:16:55+00:00 | Vulnerability · Source |
| CVE-2026-46439 | redhat_vex | compliance-trestle: compliance-trestle: Remote Code Execution via Recursive Server-Side Template Injection | known not affected: 2 | 2026-10-16T11:16:47+00:00 | Vulnerability · Source |
| CVE-2026-46352 | redhat_vex | Suricata: Suricata: Denial of Service via fragmented encapsulated traffic | known not affected: 1 | 2026-10-16T11:16:40+00:00 | Vulnerability · Source |
| CVE-2026-46345 | redhat_vex | compliance-trestle: compliance-trestle: Arbitrary file write via path traversal vulnerability | known not affected: 2 | 2026-10-16T11:16:37+00:00 | Vulnerability · Source |
| CVE-2026-42563 | redhat_vex | dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge | known affected: 3 known not affected: 22 | 2026-10-16T11:16:31+00:00 | Vulnerability · Source |
| CVE-2026-41292 | redhat_vex | unbound: Unbound: Denial of Service via excessive EDNS options | fixed: 200 known affected: 15 known not affected: 2 | 2026-10-16T11:16:30+00:00 | Vulnerability · Source |
| CVE-2026-35535 | redhat_vex | sudo: Sudo: Privilege escalation due to failure in privilege drop calls | fixed: 420 known not affected: 4 | 2026-10-16T11:16:24+00:00 | Vulnerability · Source |
| CVE-2026-33412 | redhat_vex | vim: Vim: Arbitrary code execution via command injection in glob() function | fixed: 667 known not affected: 168 | 2026-10-16T11:16:20+00:00 | Vulnerability · Source |
| CVE-2026-32597 | redhat_vex | pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | fixed: 1225 known affected: 16 known not affected: 2355 | 2026-10-16T11:16:16+00:00 | Vulnerability · Source |
| CVE-2026-30754 | redhat_vex | ffmpeg: FFmpeg: Arbitrary code execution via crafted H.264/HEVC RTP stream | known affected: 8 | 2026-10-16T11:16:14+00:00 | Vulnerability · Source |
| CVE-2026-22797 | redhat_vex | keystonemiddleware: OpenStack keystonemiddleware: Privilege escalation and user impersonation via forged authentication headers | fixed: 10 known affected: 1 known not affected: 3127 | 2026-10-16T11:16:10+00:00 | Vulnerability · Source |