VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
290548 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2022-30631 | redhat_vex | golang: compress/gzip: stack exhaustion in Reader.Read | fixed: 4253 known affected: 91 known not affected: 2159 | 2026-08-23T02:22:00+00:00 | Vulnerability · Source |
| CVE-2021-20329 | redhat_vex | mongo-go-driver: specific cstrings input may not be properly validated | fixed: 252 known affected: 69 known not affected: 3782 | 2026-08-23T02:18:13+00:00 | Vulnerability · Source |
| CVE-2026-42502 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering | fixed: 237 known affected: 334 known not affected: 955 | 2026-08-23T02:16:01+00:00 | Vulnerability · Source |
| CVE-2026-4437 | redhat_vex | glibc: glibc: Incorrect DNS response parsing via crafted DNS server response | fixed: 2028 known affected: 237 known not affected: 2 under investigation: 1 | 2026-08-23T02:15:47+00:00 | Vulnerability · Source |
| CVE-2026-4046 | redhat_vex | glibc: glibc: Denial of Service via iconv() function with specific character sets | fixed: 3045 known affected: 22 known not affected: 2 under investigation: 1 | 2026-08-23T02:15:45+00:00 | Vulnerability · Source |
| CVE-2026-32282 | redhat_vex | golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root | fixed: 1440 known affected: 173 known not affected: 2206 | 2026-08-23T02:14:11+00:00 | Vulnerability · Source |
| CVE-2026-32281 | redhat_vex | crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | fixed: 2067 known affected: 184 known not affected: 2106 | 2026-08-23T02:14:06+00:00 | Vulnerability · Source |
| CVE-2025-68121 | redhat_vex | crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | fixed: 7473 known affected: 194 known not affected: 4387 under investigation: 42 | 2026-08-23T02:10:29+00:00 | Vulnerability · Source |
| CVE-2025-7195 | redhat_vex | operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd | fixed: 587 known affected: 19 known not affected: 1820 | 2026-08-23T02:09:54+00:00 | Vulnerability · Source |
| CVE-2023-39325 | redhat_vex | golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) | fixed: 6046 known affected: 223 known not affected: 30360 | 2026-08-23T02:08:43+00:00 | Vulnerability · Source |
| CVE-2026-28390 | redhat_vex | openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing | fixed: 343 known affected: 205 known not affected: 391 under investigation: 7 | 2026-08-23T02:06:18+00:00 | Vulnerability · Source |
| CVE-2026-39829 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters | fixed: 1057 known affected: 111 known not affected: 2580 under investigation: 2 | 2026-08-23T02:03:32+00:00 | Vulnerability · Source |
| CVE-2026-39828 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions | fixed: 427 known affected: 93 known not affected: 2274 | 2026-08-23T02:03:26+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2740 known affected: 156 known not affected: 13124 under investigation: 1 | 2026-08-23T02:03:08+00:00 | Vulnerability · Source |
| CVE-2024-21536 | redhat_vex | http-proxy-middleware: Denial of Service | fixed: 253 known affected: 59 known not affected: 959 | 2026-08-23T01:59:39+00:00 | Vulnerability · Source |
| CVE-2020-11023 | redhat_vex | jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods | fixed: 5510 known affected: 169 known not affected: 1019 | 2026-08-23T01:53:43+00:00 | Vulnerability · Source |
| CVE-2020-9283 | redhat_vex | golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic | fixed: 75 known affected: 85 known not affected: 637 | 2026-08-23T01:53:36+00:00 | Vulnerability · Source |
| CVE-2025-61728 | redhat_vex | golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip | fixed: 7014 known affected: 110 known not affected: 4132 | 2026-08-23T01:51:46+00:00 | Vulnerability · Source |
| CVE-2025-58183 | redhat_vex | golang: archive/tar: Unbounded allocation when parsing GNU sparse map | fixed: 8922 known affected: 126 known not affected: 8349 | 2026-08-23T01:41:10+00:00 | Vulnerability · Source |
| CVE-2026-2100 | redhat_vex | p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters | fixed: 149 known not affected: 14 under investigation: 1 | 2026-08-23T01:36:09+00:00 | Vulnerability · Source |
| CVE-2025-8194 | redhat_vex | cpython: Cpython infinite loop when parsing a tarfile | fixed: 1939 known affected: 38 known not affected: 17 | 2026-08-23T01:30:27+00:00 | Vulnerability · Source |
| CVE-2026-48710 | redhat_vex | starlette: Starlette: Security restriction bypass via malformed HTTP Host header | fixed: 85 known affected: 35 known not affected: 634 | 2026-08-23T01:29:05+00:00 | Vulnerability · Source |
| CVE-2025-47277 | redhat_vex | vllm: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service | fixed: 15 known not affected: 1 | 2026-08-23T01:28:51+00:00 | Vulnerability · Source |
| CVE-2026-26960 | redhat_vex | node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation | fixed: 13 known affected: 15 known not affected: 220 | 2026-08-23T01:28:26+00:00 | Vulnerability · Source |
| CVE-2025-64329 | redhat_vex | github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks | fixed: 112 known affected: 372 known not affected: 47 under investigation: 1 | 2026-08-23T01:27:42+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 805 known affected: 254 known not affected: 4413 | 2026-08-23T01:26:49+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1941 known affected: 413 known not affected: 2590 under investigation: 1 | 2026-08-23T01:26:36+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 853 known affected: 92 known not affected: 2046 | 2026-08-23T01:26:21+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 115 known not affected: 1097 | 2026-08-23T01:25:54+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 10818 known affected: 443 known not affected: 17238 | 2026-08-23T01:25:48+00:00 | Vulnerability · Source |
| CVE-2025-12816 | redhat_vex | node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications | fixed: 460 known affected: 37 known not affected: 2169 | 2026-08-23T01:25:41+00:00 | Vulnerability · Source |
| CVE-2026-29063 | redhat_vex | immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution | fixed: 498 known affected: 34 known not affected: 12737 | 2026-08-23T01:25:34+00:00 | Vulnerability · Source |
| CVE-2026-2229 | redhat_vex | undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter | fixed: 411 known affected: 6 known not affected: 358 | 2026-08-23T01:25:27+00:00 | Vulnerability · Source |
| CVE-2026-1528 | redhat_vex | undici: undici: Denial of Service via crafted WebSocket frame with large length | fixed: 343 known affected: 6 known not affected: 345 | 2026-08-23T01:25:20+00:00 | Vulnerability · Source |
| CVE-2026-1526 | redhat_vex | undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression | fixed: 411 known affected: 7 known not affected: 357 | 2026-08-23T01:25:18+00:00 | Vulnerability · Source |
| CVE-2025-48387 | redhat_vex | tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball | fixed: 7 known affected: 6 known not affected: 64 | 2026-08-23T01:25:12+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 8083 known affected: 431 known not affected: 4939 under investigation: 2 | 2026-08-23T01:25:00+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2410 known affected: 45 known not affected: 4360 | 2026-08-23T01:24:59+00:00 | Vulnerability · Source |
| CVE-2026-54512 | redhat_vex | jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass | fixed: 541 known affected: 54 known not affected: 195 under investigation: 3 | 2026-08-23T01:24:45+00:00 | Vulnerability · Source |
| CVE-2026-50193 | redhat_vex | jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing | fixed: 12 known affected: 54 known not affected: 157 | 2026-08-23T01:24:39+00:00 | Vulnerability · Source |
| CVE-2026-42151 | redhat_vex | github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API | fixed: 275 known affected: 58 known not affected: 1432 | 2026-08-23T01:24:29+00:00 | Vulnerability · Source |
| CVE-2026-42154 | redhat_vex | github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint | fixed: 252 known affected: 39 known not affected: 4546 | 2026-08-23T01:24:29+00:00 | Vulnerability · Source |
| CVE-2025-66564 | redhat_vex | github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing | fixed: 41 known affected: 18 known not affected: 358 | 2026-08-23T01:24:19+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 329 known affected: 45 known not affected: 1294 | 2026-08-23T01:24:13+00:00 | Vulnerability · Source |
| CVE-2025-8941 | redhat_vex | linux-pam: Incomplete fix for CVE-2025-6020 | fixed: 324 known not affected: 27 | 2026-08-23T01:24:10+00:00 | Vulnerability · Source |
| CVE-2025-6020 | redhat_vex | linux-pam: Linux-pam directory Traversal | fixed: 492 known not affected: 31 | 2026-08-23T01:24:04+00:00 | Vulnerability · Source |
| CVE-2024-12085 | redhat_vex | rsync: Info Leak via Uninitialized Stack Contents | fixed: 955 known not affected: 1782 | 2026-08-23T01:23:58+00:00 | Vulnerability · Source |
| CVE-2025-68973 | redhat_vex | GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write | fixed: 394 known affected: 3 known not affected: 149 | 2026-08-23T01:23:51+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 822 known affected: 315 known not affected: 3206 | 2026-08-23T01:23:36+00:00 | Vulnerability · Source |
| CVE-2026-32283 | redhat_vex | crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages | fixed: 2738 known affected: 195 known not affected: 1419 under investigation: 1 | 2026-08-23T01:23:31+00:00 | Vulnerability · Source |