VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
287177 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2025-69873 | redhat_vex | ajv: ReDoS via $data reference | fixed: 327 known affected: 45 known not affected: 4716 | 2026-08-10T07:47:40+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2403 known affected: 161 known not affected: 12423 under investigation: 1 | 2026-08-10T07:47:28+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 501 known affected: 278 known not affected: 2659 | 2026-08-10T07:47:03+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 527 known affected: 349 known not affected: 1901 | 2026-08-10T07:46:54+00:00 | Vulnerability · Source |
| CVE-2026-12143 | redhat_vex | form-data: form-data: Form field override via CRLF injection | fixed: 136 known affected: 105 known not affected: 2393 under investigation: 2 | 2026-08-10T07:46:45+00:00 | Vulnerability · Source |
| CVE-2026-9595 | redhat_vex | webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration | fixed: 22 known affected: 40 known not affected: 2216 | 2026-08-10T07:46:30+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 7920 known affected: 434 known not affected: 4688 under investigation: 2 | 2026-08-10T07:46:16+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 10572 known affected: 449 known not affected: 16985 | 2026-08-10T07:46:16+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 2954 known affected: 395 known not affected: 34979 | 2026-08-10T07:33:02+00:00 | Vulnerability · Source |
| CVE-2024-4367 | redhat_vex | Mozilla: Arbitrary JavaScript execution in PDF.js | fixed: 326 known affected: 17 known not affected: 4 | 2026-08-10T07:32:32+00:00 | Vulnerability · Source |
| CVE-2026-12570 | redhat_vex | keras: Keras: Denial of Service via HDF5 Shape Bomb when loading malicious model files | known affected: 9 | 2026-08-10T06:57:50+00:00 | Vulnerability · Source |
| CVE-2026-66011 | redhat_vex | Imagemagick: ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options | known affected: 14 | 2026-08-10T06:56:24+00:00 | Vulnerability · Source |
| CVE-2026-67290 | redhat_vex | FreeRDP: FreeRDP: Denial of Service via malformed media data | known affected: 31 | 2026-08-10T06:54:08+00:00 | Vulnerability · Source |
| CVE-2025-47907 | redhat_vex | database/sql: Postgres Scan Race Condition | fixed: 5290 known affected: 163 known not affected: 2232 | 2026-08-10T06:50:28+00:00 | Vulnerability · Source |
| CVE-2025-65637 | redhat_vex | github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload | fixed: 2257 known affected: 268 known not affected: 22245 | 2026-08-10T06:50:28+00:00 | Vulnerability · Source |
| CVE-2025-58183 | redhat_vex | golang: archive/tar: Unbounded allocation when parsing GNU sparse map | fixed: 8914 known affected: 125 known not affected: 8336 | 2026-08-10T06:49:41+00:00 | Vulnerability · Source |
| CVE-2025-61728 | redhat_vex | golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip | fixed: 7014 known affected: 110 known not affected: 4132 | 2026-08-10T06:49:10+00:00 | Vulnerability · Source |
| CVE-2024-24786 | redhat_vex | golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON | fixed: 2132 known affected: 114 known not affected: 11938 under investigation: 56 | 2026-08-10T06:47:18+00:00 | Vulnerability · Source |
| CVE-2022-41723 | redhat_vex | golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding | fixed: 1556 known affected: 284 known not affected: 11950 | 2026-08-10T06:47:14+00:00 | Vulnerability · Source |
| CVE-2022-30631 | redhat_vex | golang: compress/gzip: stack exhaustion in Reader.Read | fixed: 4253 known affected: 91 known not affected: 2159 | 2026-08-10T06:47:13+00:00 | Vulnerability · Source |
| CVE-2026-42035 | redhat_vex | axios: Axios: Arbitrary HTTP header injection via prototype pollution | fixed: 171 known affected: 42 known not affected: 2574 | 2026-08-10T06:42:11+00:00 | Vulnerability · Source |
| CVE-2026-34043 | redhat_vex | serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization | fixed: 574 known affected: 58 known not affected: 2868 | 2026-08-10T06:42:09+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 955 known affected: 128 known not affected: 1035 under investigation: 3 | 2026-08-10T06:41:23+00:00 | Vulnerability · Source |
| CVE-2026-25679 | redhat_vex | net/url: Incorrect parsing of IPv6 host literals in net/url | fixed: 9353 known affected: 164 known not affected: 4344 under investigation: 1 | 2026-08-10T06:41:04+00:00 | Vulnerability · Source |
| CVE-2025-68121 | redhat_vex | crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | fixed: 7462 known affected: 203 known not affected: 3983 under investigation: 43 | 2026-08-10T06:40:48+00:00 | Vulnerability · Source |
| CVE-2026-26996 | redhat_vex | minimatch: minimatch: Denial of Service via specially crafted glob patterns | fixed: 765 known affected: 35 known not affected: 5209 | 2026-08-10T06:40:22+00:00 | Vulnerability · Source |
| CVE-2021-20329 | redhat_vex | mongo-go-driver: specific cstrings input may not be properly validated | fixed: 252 known affected: 68 known not affected: 3782 | 2026-08-10T06:37:04+00:00 | Vulnerability · Source |
| CVE-2026-67864 | redhat_vex | open62541: open62541: Denial of Service via NodeManagement type-instantiation logic | known not affected: 1 | 2026-08-10T06:36:43+00:00 | Vulnerability · Source |
| CVE-2026-67861 | redhat_vex | open62541: open62541: Denial of Service via UA_Client_getRemoteDataTypes component | known not affected: 1 | 2026-08-10T06:36:35+00:00 | Vulnerability · Source |
| CVE-2026-67860 | redhat_vex | open62541: open62541: Heap-based buffer overflow in HistoryRead path | known not affected: 1 | 2026-08-10T06:36:34+00:00 | Vulnerability · Source |
| CVE-2026-13149 | redhat_vex | brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity | fixed: 362 known affected: 93 known not affected: 1173 | 2026-08-10T06:36:09+00:00 | Vulnerability · Source |
| CVE-2026-6479 | redhat_vex | postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation | fixed: 2364 known affected: 24 known not affected: 4 | 2026-08-10T06:35:56+00:00 | Vulnerability · Source |
| CVE-2026-56000 | redhat_vex | X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() | fixed: 121 known affected: 19 known not affected: 20 | 2026-08-10T06:35:54+00:00 | Vulnerability · Source |
| CVE-2026-55999 | redhat_vex | xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow | fixed: 691 known not affected: 9 | 2026-08-10T06:35:44+00:00 | Vulnerability · Source |
| CVE-2026-35469 | redhat_vex | Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code | fixed: 457 known affected: 73 known not affected: 20677 | 2026-08-10T06:35:42+00:00 | Vulnerability · Source |
| CVE-2026-33810 | redhat_vex | crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application | fixed: 135 known affected: 271 known not affected: 939 | 2026-08-10T06:35:39+00:00 | Vulnerability · Source |
| CVE-2026-27137 | redhat_vex | crypto/x509: Incorrect enforcement of email constraints in crypto/x509 | fixed: 348 known affected: 134 known not affected: 1145 | 2026-08-10T06:35:31+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 807 known affected: 101 known not affected: 954 | 2026-08-10T06:35:21+00:00 | Vulnerability · Source |
| CVE-2026-39828 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions | fixed: 399 known affected: 93 known not affected: 1235 | 2026-08-10T06:35:16+00:00 | Vulnerability · Source |
| CVE-2026-29063 | redhat_vex | immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution | fixed: 498 known affected: 34 known not affected: 12737 | 2026-08-10T06:35:02+00:00 | Vulnerability · Source |
| CVE-2026-25639 | redhat_vex | axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig | fixed: 170 known affected: 34 known not affected: 3907 | 2026-08-10T06:34:44+00:00 | Vulnerability · Source |
| CVE-2026-24049 | redhat_vex | wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking | fixed: 176 known affected: 58 known not affected: 7114 | 2026-08-10T06:34:33+00:00 | Vulnerability · Source |
| CVE-2026-22029 | redhat_vex | @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects | fixed: 386 known affected: 62 known not affected: 8671 | 2026-08-10T06:34:28+00:00 | Vulnerability · Source |
| CVE-2026-13676 | redhat_vex | fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization | fixed: 69 known affected: 70 known not affected: 3487 | 2026-08-10T06:34:20+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 329 known affected: 63 known not affected: 1294 | 2026-08-10T06:34:03+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1941 known affected: 413 known not affected: 2590 under investigation: 1 | 2026-08-10T06:33:50+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 115 known not affected: 1097 | 2026-08-10T06:33:33+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2384 known affected: 44 known not affected: 4070 | 2026-08-10T06:33:17+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3041 known affected: 76 known not affected: 11728 | 2026-08-10T06:33:10+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2839 known affected: 53 known not affected: 6259 under investigation: 1 | 2026-08-10T06:33:00+00:00 | Vulnerability · Source |