VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
303440 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-42585 | redhat_vex | netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing | fixed: 400 known affected: 47 known not affected: 4722 | 2026-09-30T14:12:50+00:00 | Vulnerability · Source |
| CVE-2026-103044 | redhat_vex | mediawiki: EasyTimeline should not serve image maps as application/xml | known not affected: 1 | 2026-09-30T14:06:12+00:00 | Vulnerability · Source |
| CVE-2026-101295 | redhat_vex | oc-mirror: oc-mirror: Path traversal / arbitrary file write in operator catalog image extraction | under investigation: 3 | 2026-09-30T14:06:12+00:00 | Vulnerability · Source |
| CVE-2026-86248 | redhat_vex | tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | known affected: 29 known not affected: 38 under investigation: 26 | 2026-09-30T14:06:06+00:00 | Vulnerability · Source |
| CVE-2026-80932 | redhat_vex | kernel: vsock/virtio: flush works in dependency order | known affected: 262 known not affected: 14 | 2026-09-30T14:06:04+00:00 | Vulnerability · Source |
| CVE-2026-76905 | redhat_vex | github.com/getkin/kin-openapi: kin-openapi: Denial of Service via malformed multipart/form-data body | known affected: 66 known not affected: 67 | 2026-09-30T14:05:54+00:00 | Vulnerability · Source |
| CVE-2026-52910 | redhat_vex | kernel: bpf: Free reuseport cBPF prog after RCU grace period | known affected: 232 known not affected: 42 | 2026-09-30T14:05:46+00:00 | Vulnerability · Source |
| CVE-2026-34500 | redhat_vex | Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration | fixed: 51 known affected: 10 known not affected: 37 | 2026-09-30T14:05:44+00:00 | Vulnerability · Source |
| CVE-2026-26996 | redhat_vex | minimatch: minimatch: Denial of Service via specially crafted glob patterns | fixed: 796 known affected: 36 known not affected: 9247 | 2026-09-30T14:05:35+00:00 | Vulnerability · Source |
| CVE-2026-42584 | redhat_vex | netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion | fixed: 435 known affected: 25 known not affected: 5264 | 2026-09-30T14:05:30+00:00 | Vulnerability · Source |
| CVE-2026-42583 | redhat_vex | netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder | fixed: 26 known affected: 29 known not affected: 292 | 2026-09-30T14:05:24+00:00 | Vulnerability · Source |
| CVE-2026-42581 | redhat_vex | netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers | fixed: 435 known affected: 33 known not affected: 5256 | 2026-09-30T14:05:12+00:00 | Vulnerability · Source |
| CVE-2026-42578 | redhat_vex | netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation | fixed: 435 known affected: 27 known not affected: 5262 | 2026-09-30T14:05:05+00:00 | Vulnerability · Source |
| CVE-2026-27830 | redhat_vex | c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects | fixed: 26 known affected: 9 known not affected: 2805 | 2026-09-30T14:04:55+00:00 | Vulnerability · Source |
| CVE-2026-27727 | redhat_vex | com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects | fixed: 35 known affected: 8 known not affected: 2991 | 2026-09-30T14:04:52+00:00 | Vulnerability · Source |
| CVE-2026-88920 | redhat_vex | org.apache.wss4j/wss4j-ws-security-dom: Apache WSS4J: Authentication bypass via unsigned SAML sender-vouches assertion | known affected: 10 | 2026-09-30T14:04:41+00:00 | Vulnerability · Source |
| CVE-2026-84782 | redhat_vex | openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission | fixed: 35 known affected: 392 known not affected: 330 | 2026-09-30T14:04:34+00:00 | Vulnerability · Source |
| CVE-2026-56862 | redhat_vex | crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | fixed: 5504 known affected: 277 known not affected: 2789 | 2026-09-30T14:04:23+00:00 | Vulnerability · Source |
| CVE-2026-56860 | redhat_vex | net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | fixed: 5545 known affected: 288 known not affected: 2948 | 2026-09-30T14:03:59+00:00 | Vulnerability · Source |
| CVE-2026-56859 | redhat_vex | encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | fixed: 5036 known affected: 268 known not affected: 3162 | 2026-09-30T14:03:30+00:00 | Vulnerability · Source |
| CVE-2026-56858 | redhat_vex | html/template: golang: Go html/template: Cross-Site Scripting via pathological input | fixed: 5214 known affected: 235 known not affected: 2706 | 2026-09-30T14:03:12+00:00 | Vulnerability · Source |
| CVE-2026-41178 | redhat_vex | github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers | fixed: 1079 known affected: 215 known not affected: 6387 | 2026-09-30T14:03:06+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 940 known affected: 89 known not affected: 4892 | 2026-09-30T14:02:56+00:00 | Vulnerability · Source |
| CVE-2026-39831 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check | fixed: 392 known affected: 138 known not affected: 5708 | 2026-09-30T14:02:52+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2952 known affected: 151 known not affected: 16580 | 2026-09-30T14:02:45+00:00 | Vulnerability · Source |
| CVE-2026-33818 | redhat_vex | encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | fixed: 5486 known affected: 203 known not affected: 2559 | 2026-09-30T14:02:42+00:00 | Vulnerability · Source |
| CVE-2026-33814 | redhat_vex | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | fixed: 2080 known affected: 388 known not affected: 25926 under investigation: 496 | 2026-09-30T14:02:38+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3331 known affected: 372 known not affected: 39048 | 2026-09-30T14:02:31+00:00 | Vulnerability · Source |
| CVE-2026-17106 | redhat_vex | github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction | fixed: 152 known affected: 74 known not affected: 282 | 2026-09-30T14:02:25+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 1342 known affected: 179 known not affected: 13764 | 2026-09-30T14:02:25+00:00 | Vulnerability · Source |
| CVE-2025-13281 | redhat_vex | kube-controller-manager: Portworx Half-Blind SSRF in kube-controller-manager | known affected: 140 | 2026-09-30T14:02:25+00:00 | Vulnerability · Source |
| CVE-2026-15789 | redhat_vex | buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability | fixed: 46 known affected: 107 known not affected: 82 | 2026-09-30T14:02:25+00:00 | Vulnerability · Source |
| CVE-2026-91103 | redhat_vex | hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service | known affected: 29 | 2026-09-30T13:50:08+00:00 | Vulnerability · Source |
| CVE-2026-93749 | redhat_vex | source-map-js: source-map-js: Denial of Service via malformed indexed source maps | known affected: 111 known not affected: 66 | 2026-09-30T13:50:02+00:00 | Vulnerability · Source |
| CVE-2026-91100 | redhat_vex | hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. | known affected: 29 | 2026-09-30T13:49:56+00:00 | Vulnerability · Source |
| CVE-2026-91101 | redhat_vex | hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities | known affected: 29 | 2026-09-30T13:49:56+00:00 | Vulnerability · Source |
| CVE-2026-91099 | redhat_vex | hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation | known affected: 24 | 2026-09-30T13:49:56+00:00 | Vulnerability · Source |
| CVE-2026-92599 | redhat_vex | joi: joi: Denial of Service via `isoDate` validation regular expression | fixed: 9 known affected: 16 known not affected: 20 | 2026-09-30T13:49:56+00:00 | Vulnerability · Source |
| CVE-2026-102265 | redhat_vex | pyjwt: pyjwt: Denial of Service via deeply nested token headers | known affected: 189 known not affected: 37 under investigation: 20 | 2026-09-30T13:23:40+00:00 | Vulnerability · Source |
| CVE-2026-102010 | redhat_vex | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if | fixed: 9 known affected: 273 known not affected: 20 | 2026-09-30T13:23:35+00:00 | Vulnerability · Source |
| CVE-2026-62146 | redhat_vex | cri-o: cri-o: Sandbox state poisoning via pod annotations may expose runtime socket | known affected: 2 | 2026-09-30T13:22:49+00:00 | Vulnerability · Source |
| CVE-2026-56852 | redhat_vex | golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input | fixed: 758 known affected: 97 known not affected: 7986 under investigation: 237 | 2026-09-30T13:22:18+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1304 known affected: 241 known not affected: 8406 | 2026-09-30T13:21:41+00:00 | Vulnerability · Source |
| CVE-2026-15815 | redhat_vex | grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION | known affected: 23 known not affected: 4 under investigation: 3 | 2026-09-30T13:21:33+00:00 | Vulnerability · Source |
| CVE-2026-15792 | redhat_vex | github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request | fixed: 40 known affected: 75 known not affected: 320 | 2026-09-30T13:21:33+00:00 | Vulnerability · Source |
| CVE-2025-66471 | redhat_vex | urllib3: urllib3 Streaming API improperly handles highly compressed data | fixed: 1963 known affected: 127 known not affected: 3642 | 2026-09-30T13:21:33+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1984 known affected: 381 known not affected: 2958 | 2026-09-30T13:21:33+00:00 | Vulnerability · Source |
| CVE-2026-87022 | redhat_vex | tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling | fixed: 42 known affected: 90 known not affected: 1 | 2026-09-30T13:11:54+00:00 | Vulnerability · Source |
| CVE-2026-78437 | redhat_vex | tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request | fixed: 42 known affected: 50 known not affected: 41 | 2026-09-30T13:11:49+00:00 | Vulnerability · Source |
| CVE-2026-77762 | redhat_vex | tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation | fixed: 42 known affected: 87 known not affected: 4 | 2026-09-30T13:11:49+00:00 | Vulnerability · Source |