{"metadata": {"count": 288841, "page": 1, "per_page": 50}, "data": [{"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:14:55+00:00", "cve": "CVE-2026-34040", "id": "CVE-2026-34040", "initial_release_date": "2026-03-31T01:36:48.205000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "Moby: Moby: Authorization bypass vulnerability", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34040.json", "version": "3", "product_status": {"fixed": 16, "known_affected": 10, "known_not_affected": 78}, "imported": 1786986895.0, "vulnerability_id": "CVE-2026-34040", "vulnerability_url": "/vuln/CVE-2026-34040"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:14:29+00:00", "cve": "CVE-2025-68121", "id": "CVE-2025-68121", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68121.json", "version": "3", "product_status": {"fixed": 7469, "known_affected": 195, "known_not_affected": 4201, "under_investigation": 42}, "imported": 1786986869.0, "vulnerability_id": "CVE-2025-68121", "vulnerability_url": "/vuln/CVE-2025-68121"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:14:12+00:00", "cve": "CVE-2025-61728", "id": "CVE-2025-61728", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61728.json", "version": "3", "product_status": {"fixed": 7014, "known_affected": 110, "known_not_affected": 4132}, "imported": 1786986852.0, "vulnerability_id": "CVE-2025-61728", "vulnerability_url": "/vuln/CVE-2025-61728"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:14:02+00:00", "cve": "CVE-2025-22866", "id": "CVE-2025-22866", "initial_release_date": "2025-02-06T16:54:10.252000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22866.json", "version": "3", "product_status": {"fixed": 478, "known_affected": 398, "known_not_affected": 641}, "imported": 1786986842.0, "vulnerability_id": "CVE-2025-22866", "vulnerability_url": "/vuln/CVE-2025-22866"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:13:47+00:00", "cve": "CVE-2024-45336", "id": "CVE-2024-45336", "initial_release_date": "2024-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45336.json", "version": "3", "product_status": {"fixed": 572, "known_affected": 520, "known_not_affected": 563}, "imported": 1786986827.0, "vulnerability_id": "CVE-2024-45336", "vulnerability_url": "/vuln/CVE-2024-45336"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:13:41+00:00", "cve": "CVE-2026-39829", "id": "CVE-2026-39829", "initial_release_date": "2026-05-22T02:31:27.324000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json", "version": "3", "product_status": {"fixed": 1045, "known_affected": 104, "known_not_affected": 2276, "under_investigation": 2}, "imported": 1786986821.0, "vulnerability_id": "CVE-2026-39829", "vulnerability_url": "/vuln/CVE-2026-39829"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:13:37+00:00", "cve": "CVE-2026-29181", "id": "CVE-2026-29181", "initial_release_date": "2026-04-07T20:29:13.933000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json", "version": "3", "product_status": {"fixed": 8, "known_affected": 11, "known_not_affected": 229, "under_investigation": 1}, "imported": 1786986817.0, "vulnerability_id": "CVE-2026-29181", "vulnerability_url": "/vuln/CVE-2026-29181"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:13:31+00:00", "cve": "CVE-2026-27830", "id": "CVE-2026-27830", "initial_release_date": "2026-02-26T00:45:18.222000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27830.json", "version": "3", "product_status": {"fixed": 14, "known_affected": 15, "known_not_affected": 274}, "imported": 1786986811.0, "vulnerability_id": "CVE-2026-27830", "vulnerability_url": "/vuln/CVE-2026-27830"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:13:27+00:00", "cve": "CVE-2025-69223", "id": "CVE-2025-69223", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json", "version": "3", "product_status": {"fixed": 220, "known_affected": 32, "known_not_affected": 6340}, "imported": 1786986807.0, "vulnerability_id": "CVE-2025-69223", "vulnerability_url": "/vuln/CVE-2025-69223"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:13:26+00:00", "cve": "CVE-2025-61726", "id": "CVE-2025-61726", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "version": "3", "product_status": {"fixed": 10584, "known_affected": 443, "known_not_affected": 17196}, "imported": 1786986806.0, "vulnerability_id": "CVE-2025-61726", "vulnerability_url": "/vuln/CVE-2025-61726"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:13:24+00:00", "cve": "CVE-2025-61729", "id": "CVE-2025-61729", "initial_release_date": "2025-12-02T18:54:10.166000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61729.json", "version": "3", "product_status": {"fixed": 7927, "known_affected": 432, "known_not_affected": 4900, "under_investigation": 2}, "imported": 1786986804.0, "vulnerability_id": "CVE-2025-61729", "vulnerability_url": "/vuln/CVE-2025-61729"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:01:55+00:00", "cve": "CVE-2026-42502", "id": "CVE-2026-42502", "initial_release_date": "2026-05-22T15:01:21.649000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42502.json", "version": "3", "product_status": {"fixed": 213, "known_affected": 347, "known_not_affected": 619, "under_investigation": 1}, "imported": 1786986115.0, "vulnerability_id": "CVE-2026-42502", "vulnerability_url": "/vuln/CVE-2026-42502"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T17:01:32+00:00", "cve": "CVE-2026-42033", "id": "CVE-2026-42033", "initial_release_date": "2026-04-24T17:36:44.132000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42033.json", "version": "3", "product_status": {"fixed": 145, "known_affected": 37, "known_not_affected": 3093}, "imported": 1786986092.0, "vulnerability_id": "CVE-2026-42033", "vulnerability_url": "/vuln/CVE-2026-42033"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T17:00:03+00:00", "cve": "CVE-2026-72020", "id": "CVE-2026-72020", "initial_release_date": "2026-08-15T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "kernel: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72020.json", "version": "3", "product_status": {"known_affected": 274}, "imported": 1786986003.0, "vulnerability_id": "CVE-2026-72020", "vulnerability_url": "/vuln/CVE-2026-72020"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:59:57+00:00", "cve": "CVE-2026-72018", "id": "CVE-2026-72018", "initial_release_date": "2026-08-15T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "kernel: dibs: loopback: validate offset and size in move_data()", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72018.json", "version": "3", "product_status": {"known_not_affected": 274}, "imported": 1786985997.0, "vulnerability_id": "CVE-2026-72018", "vulnerability_url": "/vuln/CVE-2026-72018"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:59:48+00:00", "cve": "CVE-2026-59881", "id": "CVE-2026-59881", "initial_release_date": "2026-07-30T17:34:32.415000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "aiohttp: AIOHTTP: Denial of Service via unnegotiated WebSocket compression", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59881.json", "version": "3", "product_status": {"known_affected": 138, "known_not_affected": 31}, "imported": 1786985988.0, "vulnerability_id": "CVE-2026-59881", "vulnerability_url": "/vuln/CVE-2026-59881"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:59:39+00:00", "cve": "CVE-2026-72021", "id": "CVE-2026-72021", "initial_release_date": "2026-08-15T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "kernel: ipvs: use parsed transport offset in SCTP state lookup", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72021.json", "version": "3", "product_status": {"known_affected": 76, "known_not_affected": 198}, "imported": 1786985979.0, "vulnerability_id": "CVE-2026-72021", "vulnerability_url": "/vuln/CVE-2026-72021"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:59:34+00:00", "cve": "CVE-2026-72238", "id": "CVE-2026-72238", "initial_release_date": "2026-08-15T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "kernel: x86/boot: Validate console=uart8250 baud rate to fix early boot hang", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72238.json", "version": "3", "product_status": {"known_not_affected": 274}, "imported": 1786985974.0, "vulnerability_id": "CVE-2026-72238", "vulnerability_url": "/vuln/CVE-2026-72238"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:59:22+00:00", "cve": "CVE-2026-72022", "id": "CVE-2026-72022", "initial_release_date": "2026-08-15T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "kernel: llc: fix SAP refcount leak in llc_ui_autobind()", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72022.json", "version": "3", "product_status": {"known_not_affected": 274}, "imported": 1786985962.0, "vulnerability_id": "CVE-2026-72022", "vulnerability_url": "/vuln/CVE-2026-72022"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T16:59:15+00:00", "cve": "CVE-2026-73089", "id": "CVE-2026-73089", "initial_release_date": "2026-08-11T17:05:38.760000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73089.json", "version": "3", "product_status": {"fixed": 8, "known_affected": 124, "known_not_affected": 108}, "imported": 1786985955.0, "vulnerability_id": "CVE-2026-73089", "vulnerability_url": "/vuln/CVE-2026-73089"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T16:59:12+00:00", "cve": "CVE-2026-73643", "id": "CVE-2026-73643", "initial_release_date": "2026-08-13T17:47:30.404000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73643.json", "version": "3", "product_status": {"known_affected": 79, "known_not_affected": 323}, "imported": 1786985952.0, "vulnerability_id": "CVE-2026-73643", "vulnerability_url": "/vuln/CVE-2026-73643"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T16:59:10+00:00", "cve": "CVE-2026-71235", "id": "CVE-2026-71235", "initial_release_date": "2026-08-05T10:56:25.198000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/absmach/magistrala: Magistrala IoT Platform: Arbitrary Code Execution via Unrestricted Script Execution", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71235.json", "version": "3", "product_status": {"known_affected": 162, "known_not_affected": 231}, "imported": 1786985950.0, "vulnerability_id": "CVE-2026-71235", "vulnerability_url": "/vuln/CVE-2026-71235"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T16:58:56+00:00", "cve": "CVE-2026-67312", "id": "CVE-2026-67312", "initial_release_date": "2026-08-01T12:22:18.102000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "axios: axios: Denial of Service via uncontrolled recursion in form data processing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67312.json", "version": "3", "product_status": {"fixed": 9, "known_not_affected": 10, "under_investigation": 99}, "imported": 1786985936.0, "vulnerability_id": "CVE-2026-67312", "vulnerability_url": "/vuln/CVE-2026-67312"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-08-17T16:58:53+00:00", "cve": "CVE-2026-66808", "id": "CVE-2026-66808", "initial_release_date": "2026-08-06T20:21:07.177000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "hypershift-addon-operator: hypershift-addon-operator: unsanitized hub ConfigMap data passed as CLI arguments to privileged install Job (argument injection)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66808.json", "version": "3", "product_status": {"fixed": 4, "known_not_affected": 120}, "imported": 1786985933.0, "vulnerability_id": "CVE-2026-66808", "vulnerability_url": "/vuln/CVE-2026-66808"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:38:41+00:00", "cve": "CVE-2026-44309", "id": "CVE-2026-44309", "initial_release_date": "2026-05-15T16:22:51.260000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/sigstore/gitsign: github.com/go-git/go-git: Gitsign: Signature verification bypass due to object re-encoding", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44309.json", "version": "3", "product_status": {"known_affected": 1}, "imported": 1786984721.0, "vulnerability_id": "CVE-2026-44309", "vulnerability_url": "/vuln/CVE-2026-44309"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:32+00:00", "cve": "CVE-2026-41004", "id": "CVE-2026-41004", "initial_release_date": "2026-05-07T03:51:31.920000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "Spring Cloud Config Server: Spring Cloud Config: Spring Cloud Config Server: Information disclosure via trace logging", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41004.json", "version": "3", "product_status": {"known_affected": 5}, "imported": 1786984532.0, "vulnerability_id": "CVE-2026-41004", "vulnerability_url": "/vuln/CVE-2026-41004"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:29+00:00", "cve": "CVE-2026-40312", "id": "CVE-2026-40312", "initial_release_date": "2026-04-13T21:43:28.416000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick and Magick.NET: Denial of Service via malicious MSL file processing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40312.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984529.0, "vulnerability_id": "CVE-2026-40312", "vulnerability_url": "/vuln/CVE-2026-40312"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:23+00:00", "cve": "CVE-2026-40311", "id": "CVE-2026-40311", "initial_release_date": "2026-04-13T21:36:44.262000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via heap use-after-free in XMP profile processing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40311.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984523.0, "vulnerability_id": "CVE-2026-40311", "vulnerability_url": "/vuln/CVE-2026-40311"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:18+00:00", "cve": "CVE-2026-40310", "id": "CVE-2026-40310", "initial_release_date": "2026-04-13T21:32:53.361000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of service via heap out-of-bounds write in JP2 encoder", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40310.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984518.0, "vulnerability_id": "CVE-2026-40310", "vulnerability_url": "/vuln/CVE-2026-40310"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:15+00:00", "cve": "CVE-2026-40183", "id": "CVE-2026-40183", "initial_release_date": "2026-04-13T21:28:20.797000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via heap write overflow in JXL encoder", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40183.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984515.0, "vulnerability_id": "CVE-2026-40183", "vulnerability_url": "/vuln/CVE-2026-40183"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:10+00:00", "cve": "CVE-2026-40169", "id": "CVE-2026-40169", "initial_release_date": "2026-04-13T21:25:56.317000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via crafted image leading to out-of-bounds write", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40169.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984510.0, "vulnerability_id": "CVE-2026-40169", "vulnerability_url": "/vuln/CVE-2026-40169"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:06+00:00", "cve": "CVE-2026-34238", "id": "CVE-2026-34238", "initial_release_date": "2026-04-13T21:14:07.180000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via integer overflow in despeckle operation", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34238.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984506.0, "vulnerability_id": "CVE-2026-34238", "vulnerability_url": "/vuln/CVE-2026-34238"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:35:02+00:00", "cve": "CVE-2026-33905", "id": "CVE-2026-33905", "initial_release_date": "2026-04-13T21:02:58.121000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: ImageMagick: Denial of service via out-of-bounds read in -sample operation", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33905.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984502.0, "vulnerability_id": "CVE-2026-33905", "vulnerability_url": "/vuln/CVE-2026-33905"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:57+00:00", "cve": "CVE-2026-33902", "id": "CVE-2026-33902", "initial_release_date": "2026-04-13T20:59:47.120000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: ImageMagick: Denial of Service via deeply nested expression in FX parser", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33902.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984497.0, "vulnerability_id": "CVE-2026-33902", "vulnerability_url": "/vuln/CVE-2026-33902"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:54+00:00", "cve": "CVE-2026-33900", "id": "CVE-2026-33900", "initial_release_date": "2026-04-13T20:50:19.615000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via integer truncation in viff encoder", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33900.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984494.0, "vulnerability_id": "CVE-2026-33900", "vulnerability_url": "/vuln/CVE-2026-33900"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:52+00:00", "cve": "CVE-2026-33899", "id": "CVE-2026-33899", "initial_release_date": "2026-04-13T20:46:43.781000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via out-of-bounds write in XML parsing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33899.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984492.0, "vulnerability_id": "CVE-2026-33899", "vulnerability_url": "/vuln/CVE-2026-33899"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:45+00:00", "cve": "CVE-2026-33536", "id": "CVE-2026-33536", "initial_release_date": "2026-03-26T19:57:53.619000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: ImageMagick: Denial of Service via out-of-bounds write", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33536.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984485.0, "vulnerability_id": "CVE-2026-33536", "vulnerability_url": "/vuln/CVE-2026-33536"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:38+00:00", "cve": "CVE-2026-33349", "id": "CVE-2026-33349", "initial_release_date": "2026-03-24T19:35:47.908000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33349.json", "version": "3", "product_status": {"fixed": 1, "known_affected": 17, "known_not_affected": 2}, "imported": 1786984478.0, "vulnerability_id": "CVE-2026-33349", "vulnerability_url": "/vuln/CVE-2026-33349"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:33+00:00", "cve": "CVE-2026-33249", "id": "CVE-2026-33249", "initial_release_date": "2026-03-25T20:21:30.156000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/nats-io/nats-server: NATS-Server: Unauthorized trace message redirection via message tracing headers", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33249.json", "version": "3", "product_status": {"known_affected": 2}, "imported": 1786984473.0, "vulnerability_id": "CVE-2026-33249", "vulnerability_url": "/vuln/CVE-2026-33249"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:32+00:00", "cve": "CVE-2026-33248", "id": "CVE-2026-33248", "initial_release_date": "2026-03-25T20:18:28.923000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/nats-io/nats-server: nats: NATS-Server: Authentication bypass due to incorrect Subject DN matching during mTLS client identity verification", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33248.json", "version": "3", "product_status": {"known_affected": 2}, "imported": 1786984472.0, "vulnerability_id": "CVE-2026-33248", "vulnerability_url": "/vuln/CVE-2026-33248"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:24+00:00", "cve": "CVE-2026-33246", "id": "CVE-2026-33246", "initial_release_date": "2026-03-25T19:50:03.453000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "nats-server: nats: github.com/nats-io/nats-server: NATS-Server: Client identity spoofing via Nats-Request-Info header manipulation", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33246.json", "version": "3", "product_status": {"known_affected": 2}, "imported": 1786984464.0, "vulnerability_id": "CVE-2026-33246", "vulnerability_url": "/vuln/CVE-2026-33246"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:19+00:00", "cve": "CVE-2026-33244", "id": "CVE-2026-33244", "initial_release_date": "2026-06-02T16:59:31.104000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33244.json", "version": "3", "product_status": {"known_affected": 174}, "imported": 1786984459.0, "vulnerability_id": "CVE-2026-33244", "vulnerability_url": "/vuln/CVE-2026-33244"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:15+00:00", "cve": "CVE-2026-33223", "id": "CVE-2026-33223", "initial_release_date": "2026-03-25T20:20:00.158000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Identity spoofing via `Nats-Request-Info:` header", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33223.json", "version": "3", "product_status": {"known_affected": 2}, "imported": 1786984455.0, "vulnerability_id": "CVE-2026-33223", "vulnerability_url": "/vuln/CVE-2026-33223"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:06+00:00", "cve": "CVE-2026-33222", "id": "CVE-2026-33222", "initial_release_date": "2026-03-25T20:10:51.107000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "nats-server: NATS-Server: Unauthorized data modification via JetStream stream restore", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33222.json", "version": "3", "product_status": {"known_affected": 2}, "imported": 1786984446.0, "vulnerability_id": "CVE-2026-33222", "vulnerability_url": "/vuln/CVE-2026-33222"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:34:00+00:00", "cve": "CVE-2026-33215", "id": "CVE-2026-33215", "initial_release_date": "2026-03-24T20:55:53.455000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33215.json", "version": "3", "product_status": {"fixed": 12, "known_not_affected": 52}, "imported": 1786984440.0, "vulnerability_id": "CVE-2026-33215", "vulnerability_url": "/vuln/CVE-2026-33215"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:33:57+00:00", "cve": "CVE-2026-32636", "id": "CVE-2026-32636", "initial_release_date": "2026-03-18T20:39:44.447000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: ImageMagick: Denial of Service via out-of-bounds write in NewXMLTree method", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32636.json", "version": "3", "product_status": {"fixed": 51, "known_affected": 7}, "imported": 1786984437.0, "vulnerability_id": "CVE-2026-32636", "vulnerability_url": "/vuln/CVE-2026-32636"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:33:51+00:00", "cve": "CVE-2026-32259", "id": "CVE-2026-32259", "initial_release_date": "2026-03-12T19:38:12.192000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "ImageMagick: stack-based buffer overflow in sixel encoder", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32259.json", "version": "3", "product_status": {"known_affected": 14}, "imported": 1786984431.0, "vulnerability_id": "CVE-2026-32259", "vulnerability_url": "/vuln/CVE-2026-32259"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:33:48+00:00", "cve": "CVE-2026-3449", "id": "CVE-2026-3449", "initial_release_date": "2026-03-03T05:00:01.085000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3449.json", "version": "3", "product_status": {"known_affected": 34}, "imported": 1786984428.0, "vulnerability_id": "CVE-2026-3449", "vulnerability_url": "/vuln/CVE-2026-3449"}, {"meta_source": "redhat_vex", "current_release_date": "2026-08-17T16:33:43+00:00", "cve": "CVE-2026-3408", "id": "CVE-2026-3408", "initial_release_date": "2026-03-02T03:32:10.760000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "openbabel: NULL pointer dereference when parsing a malformed CDXML file", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3408.json", "version": "3", "product_status": {"known_not_affected": 1}, "imported": 1786984423.0, "vulnerability_id": "CVE-2026-3408", "vulnerability_url": "/vuln/CVE-2026-3408"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-08-17T16:33:41+00:00", "cve": "CVE-2026-3337", "id": "CVE-2026-3337", "initial_release_date": "2026-03-02T21:20:08.532000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "aws-lc: AWS-LC: Information disclosure via timing discrepancy in AES-CCM decryption", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3337.json", "version": "3", "product_status": {"known_affected": 15}, "imported": 1786984421.0, "vulnerability_id": "CVE-2026-3337", "vulnerability_url": "/vuln/CVE-2026-3337"}]}