VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
304241 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-69896 | microsoft_vex | Windows Error Reporting Elevation of Privilege Vulnerability | fixed: 8 known affected: 8 | 2026-10-13T07:00:00+00:00 | Vulnerability · Source |
| CVE-2026-104844 | redhat_vex | postcss-selector-parser: postcss-selector-parser: Denial of Service via crafted CSS selectors | known not affected: 7 | 2026-10-02T23:32:58+00:00 | Vulnerability · Source |
| CVE-2026-103387 | redhat_vex | uri-js: uri-js: Denial of Service via crafted mailto URI | known not affected: 10 | 2026-10-02T23:32:50+00:00 | Vulnerability · Source |
| CVE-2026-67408 | redhat_vex | rabbitmq-server: rabbitmq-server: Denial of Service via excessive memory allocation in stream management | known affected: 9 | 2026-10-02T23:32:49+00:00 | Vulnerability · Source |
| CVE-2026-66071 | redhat_vex | rabbitmq-server: rabbitmq-server: Denial of service via atom exhaustion in OAuth2 JWT scope parsing | known affected: 9 | 2026-10-02T23:32:32+00:00 | Vulnerability · Source |
| CVE-2026-42502 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering | fixed: 788 known affected: 239 known not affected: 5661 | 2026-10-02T23:32:31+00:00 | Vulnerability · Source |
| CVE-2026-102555 | redhat_vex | libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding | known affected: 10 known not affected: 6 | 2026-10-02T23:32:21+00:00 | Vulnerability · Source |
| CVE-2026-57516 | redhat_vex | ray: Ray: Remote code execution via unsafe deserialization in WebDataset reader | fixed: 4 known affected: 14 known not affected: 5 | 2026-10-02T23:32:16+00:00 | Vulnerability · Source |
| CVE-2026-56860 | redhat_vex | net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | fixed: 7334 known affected: 274 known not affected: 3610 | 2026-10-02T23:32:04+00:00 | Vulnerability · Source |
| CVE-2026-56859 | redhat_vex | encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | fixed: 6850 known affected: 248 known not affected: 3466 | 2026-10-02T23:31:54+00:00 | Vulnerability · Source |
| CVE-2026-56858 | redhat_vex | html/template: golang: Go html/template: Cross-Site Scripting via pathological input | fixed: 6774 known affected: 215 known not affected: 3326 | 2026-10-02T23:31:46+00:00 | Vulnerability · Source |
| CVE-2026-41178 | redhat_vex | github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers | fixed: 1083 known affected: 213 known not affected: 6482 | 2026-10-02T23:31:34+00:00 | Vulnerability · Source |
| CVE-2026-16221 | redhat_vex | fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency | fixed: 143 known affected: 21 known not affected: 719 under investigation: 58 | 2026-10-02T23:31:34+00:00 | Vulnerability · Source |
| CVE-2026-44740 | redhat_vex | github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation | fixed: 525 known affected: 100 known not affected: 2311 | 2026-10-02T23:31:34+00:00 | Vulnerability · Source |
| CVE-2026-11061 | redhat_vex | chromium-browser: angle: Out of bounds read in ANGLE | fixed: 92 known affected: 11 known not affected: 23 | 2026-10-02T23:31:34+00:00 | Vulnerability · Source |
| CVE-2020-8664 | redhat_vex | envoy: Incorrect Access Control when using SDS with Combined Validation Context | fixed: 2 | 2026-10-02T23:30:02+00:00 | Vulnerability · Source |
| CVE-2020-8661 | redhat_vex | envoy: Response flooding for HTTP/1.1 | fixed: 2 | 2026-10-02T23:30:01+00:00 | Vulnerability · Source |
| CVE-2020-8659 | redhat_vex | envoy: Excessive CPU and/or memory usage when proxying HTTP/1.1 | fixed: 2 | 2026-10-02T23:29:59+00:00 | Vulnerability · Source |
| CVE-2025-10502 | redhat_vex | chromium-browser: angle: Heap buffer overflow in ANGLE | fixed: 92 known affected: 11 known not affected: 23 | 2026-10-02T23:29:25+00:00 | Vulnerability · Source |
| CVE-2026-98164 | redhat_vex | kernel: KVM: x86/mmu: Check write tracking in all address spaces | known affected: 234 known not affected: 42 | 2026-10-02T23:23:27+00:00 | Vulnerability · Source |
| CVE-2026-98162 | redhat_vex | kernel: smb/server: fix tree connection leak in smb2_tree_connect() | known not affected: 276 | 2026-10-02T23:23:23+00:00 | Vulnerability · Source |
| CVE-2026-98163 | redhat_vex | kernel: cgroup: Avoid iteration of dying tasks with zero refcount | known not affected: 274 | 2026-10-02T23:23:19+00:00 | Vulnerability · Source |
| CVE-2026-95359 | redhat_vex | chromium-browser: Uninitialized resource in GPU | known not affected: 1 | 2026-10-02T23:23:08+00:00 | Vulnerability · Source |
| CVE-2026-95294 | redhat_vex | chromium-browser: UI misrepresentation in Browser | known not affected: 1 | 2026-10-02T23:23:08+00:00 | Vulnerability · Source |
| CVE-2026-95376 | redhat_vex | chromium-browser: Externally controlled reference in DevTools | known not affected: 1 | 2026-10-02T23:23:08+00:00 | Vulnerability · Source |
| CVE-2026-96775 | redhat_vex | mlflow: MLflow dspy: Arbitrary code execution via crafted MLmodel artifact | known affected: 15 known not affected: 7 | 2026-10-02T23:23:08+00:00 | Vulnerability · Source |
| CVE-2026-98161 | redhat_vex | kernel: nvdimm: pmem: keep PREFLUSH before data writes | known affected: 234 known not affected: 42 | 2026-10-02T23:23:08+00:00 | Vulnerability · Source |
| CVE-2026-32281 | redhat_vex | crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | fixed: 2325 known affected: 166 known not affected: 2210 | 2026-10-02T22:10:41+00:00 | Vulnerability · Source |
| CVE-2025-61728 | redhat_vex | golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip | fixed: 7014 known affected: 113 known not affected: 4133 | 2026-10-02T22:10:31+00:00 | Vulnerability · Source |
| CVE-2025-58183 | redhat_vex | golang: archive/tar: Unbounded allocation when parsing GNU sparse map | fixed: 9024 known affected: 132 known not affected: 8347 | 2026-10-02T22:10:30+00:00 | Vulnerability · Source |
| CVE-2026-94638 | redhat_vex | thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings | fixed: 13 known affected: 12 | 2026-10-02T22:10:26+00:00 | Vulnerability · Source |
| CVE-2026-66331 | redhat_vex | thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport | fixed: 13 known affected: 12 | 2026-10-02T22:10:25+00:00 | Vulnerability · Source |
| CVE-2026-101908 | redhat_vex | axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution | fixed: 9 known not affected: 1 | 2026-10-02T22:10:18+00:00 | Vulnerability · Source |
| CVE-2026-101907 | redhat_vex | axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter | fixed: 9 known not affected: 1 | 2026-10-02T22:10:13+00:00 | Vulnerability · Source |
| CVE-2026-101904 | redhat_vex | axios: Axios: HTTP header injection via inherited prototype properties | fixed: 9 known not affected: 1 | 2026-10-02T22:10:12+00:00 | Vulnerability · Source |
| CVE-2026-101902 | redhat_vex | axios: axios: Unintended HTTP method override via prototype pollution gadget | fixed: 9 known not affected: 1 | 2026-10-02T22:10:10+00:00 | Vulnerability · Source |
| CVE-2026-101900 | redhat_vex | axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter | fixed: 9 known not affected: 1 | 2026-10-02T22:10:06+00:00 | Vulnerability · Source |
| CVE-2026-101898 | redhat_vex | axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings | fixed: 9 known not affected: 1 | 2026-10-02T22:10:05+00:00 | Vulnerability · Source |
| CVE-2026-27145 | redhat_vex | crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | fixed: 1083 known affected: 74 known not affected: 5346 | 2026-10-02T22:08:12+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 1345 known affected: 178 known not affected: 13996 | 2026-10-02T22:08:08+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1332 known affected: 240 known not affected: 8613 | 2026-10-02T22:07:51+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 329 known affected: 42 known not affected: 1297 | 2026-10-02T22:07:42+00:00 | Vulnerability · Source |
| CVE-2025-66471 | redhat_vex | urllib3: urllib3 Streaming API improperly handles highly compressed data | fixed: 1965 known affected: 125 known not affected: 3876 | 2026-10-02T22:07:37+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1992 known affected: 379 known not affected: 2959 | 2026-10-02T22:07:23+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 115 known not affected: 1099 | 2026-10-02T22:07:18+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 8116 known affected: 434 known not affected: 5144 | 2026-10-02T22:07:09+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2419 known affected: 40 known not affected: 4478 | 2026-10-02T22:06:59+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3866 known affected: 68 known not affected: 13220 | 2026-10-02T22:06:54+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2839 known affected: 57 known not affected: 6263 under investigation: 1 | 2026-10-02T22:06:52+00:00 | Vulnerability · Source |
| CVE-2025-22868 | redhat_vex | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | fixed: 2199 known affected: 93 known not affected: 8426 | 2026-10-02T22:06:51+00:00 | Vulnerability · Source |