VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
303453 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-55969 | redhat_vex | thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound | fixed: 136 known affected: 28 known not affected: 1609 | 2026-09-30T16:27:50+00:00 | Vulnerability · Source |
| CVE-2026-54283 | redhat_vex | starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | fixed: 78 known affected: 28 known not affected: 897 | 2026-09-30T16:27:43+00:00 | Vulnerability · Source |
| CVE-2026-54058 | redhat_vex | Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image | fixed: 199 known affected: 21 known not affected: 827 | 2026-09-30T16:27:38+00:00 | Vulnerability · Source |
| CVE-2026-49855 | redhat_vex | tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption | fixed: 28 known affected: 46 known not affected: 254 | 2026-09-30T16:27:34+00:00 | Vulnerability · Source |
| CVE-2026-48779 | redhat_vex | ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments | fixed: 613 known affected: 39 known not affected: 1178 | 2026-09-30T16:27:31+00:00 | Vulnerability · Source |
| CVE-2026-48746 | redhat_vex | vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access | fixed: 40 known affected: 37 known not affected: 652 | 2026-09-30T16:27:26+00:00 | Vulnerability · Source |
| CVE-2026-48710 | redhat_vex | starlette: Starlette: Security restriction bypass via malformed HTTP Host header | fixed: 109 known affected: 30 known not affected: 1179 | 2026-09-30T16:27:13+00:00 | Vulnerability · Source |
| CVE-2026-48586 | redhat_vex | thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data | fixed: 155 known affected: 28 known not affected: 1833 | 2026-09-30T16:27:04+00:00 | Vulnerability · Source |
| CVE-2026-48526 | redhat_vex | python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens | fixed: 998 known affected: 19 known not affected: 2291 | 2026-09-30T16:26:59+00:00 | Vulnerability · Source |
| CVE-2026-46595 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation | fixed: 307 known affected: 58 known not affected: 2269 | 2026-09-30T16:26:54+00:00 | Vulnerability · Source |
| CVE-2026-45736 | redhat_vex | ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` | fixed: 435 known affected: 40 known not affected: 5116 | 2026-09-30T16:26:49+00:00 | Vulnerability · Source |
| CVE-2026-44843 | redhat_vex | langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization | fixed: 14 known affected: 10 known not affected: 569 | 2026-09-30T16:26:44+00:00 | Vulnerability · Source |
| CVE-2026-44727 | redhat_vex | jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers | fixed: 48 known not affected: 537 | 2026-09-30T16:26:40+00:00 | Vulnerability · Source |
| CVE-2026-44432 | redhat_vex | urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | fixed: 269 known affected: 29 known not affected: 1726 | 2026-09-30T16:26:24+00:00 | Vulnerability · Source |
| CVE-2026-44240 | redhat_vex | basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses | fixed: 13 known affected: 2 known not affected: 1442 | 2026-09-30T16:26:21+00:00 | Vulnerability · Source |
| CVE-2026-42508 | redhat_vex | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey | fixed: 1073 known affected: 50 known not affected: 2407 | 2026-09-30T16:26:07+00:00 | Vulnerability · Source |
| CVE-2026-42338 | redhat_vex | ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input | fixed: 508 known affected: 11 known not affected: 2965 | 2026-09-30T16:26:02+00:00 | Vulnerability · Source |
| CVE-2026-42297 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Unauthorized ConfigMap manipulation due to missing authorization | fixed: 6 known not affected: 231 | 2026-09-30T16:25:58+00:00 | Vulnerability · Source |
| CVE-2026-42296 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Privilege escalation via security control bypass | fixed: 21 known not affected: 214 | 2026-09-30T16:25:52+00:00 | Vulnerability · Source |
| CVE-2026-42294 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor | fixed: 6 known not affected: 229 | 2026-09-30T16:25:47+00:00 | Vulnerability · Source |
| CVE-2026-42215 | redhat_vex | GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks | fixed: 118 known affected: 10 known not affected: 1727 | 2026-09-30T16:25:38+00:00 | Vulnerability · Source |
| CVE-2026-41242 | redhat_vex | protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields | fixed: 61 known affected: 18 known not affected: 716 | 2026-09-30T16:25:32+00:00 | Vulnerability · Source |
| CVE-2026-40110 | redhat_vex | jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation | fixed: 23 known not affected: 239 | 2026-09-30T16:25:24+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 946 known affected: 89 known not affected: 5121 | 2026-09-30T16:25:01+00:00 | Vulnerability · Source |
| CVE-2026-39832 | redhat_vex | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions | fixed: 1018 known affected: 65 known not affected: 2497 | 2026-09-30T16:24:42+00:00 | Vulnerability · Source |
| CVE-2026-39831 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check | fixed: 398 known affected: 136 known not affected: 5937 | 2026-09-30T16:24:16+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 1129 known affected: 107 known not affected: 5471 | 2026-09-30T16:24:06+00:00 | Vulnerability · Source |
| CVE-2026-39829 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters | fixed: 1221 known affected: 101 known not affected: 10467 | 2026-09-30T16:23:47+00:00 | Vulnerability · Source |
| CVE-2026-39828 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions | fixed: 478 known affected: 83 known not affected: 4960 | 2026-09-30T16:23:46+00:00 | Vulnerability · Source |
| CVE-2026-39821 | redhat_vex | golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing | fixed: 1991 known affected: 155 known not affected: 4504 | 2026-09-30T16:23:30+00:00 | Vulnerability · Source |
| CVE-2026-35397 | redhat_vex | jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability | fixed: 48 known not affected: 537 | 2026-09-30T16:23:20+00:00 | Vulnerability · Source |
| CVE-2026-34993 | redhat_vex | aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() | fixed: 231 known affected: 29 known not affected: 2603 | 2026-09-30T16:23:14+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2973 known affected: 144 known not affected: 16794 | 2026-09-30T16:22:55+00:00 | Vulnerability · Source |
| CVE-2026-33816 | redhat_vex | github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability | fixed: 318 known affected: 42 known not affected: 1152 | 2026-09-30T16:22:51+00:00 | Vulnerability · Source |
| CVE-2026-33815 | redhat_vex | github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability | fixed: 235 known affected: 53 known not affected: 1006 | 2026-09-30T16:22:36+00:00 | Vulnerability · Source |
| CVE-2026-33811 | redhat_vex | net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | fixed: 1835 known affected: 138 known not affected: 8314 | 2026-09-30T16:22:21+00:00 | Vulnerability · Source |
| CVE-2026-33231 | redhat_vex | nltk: NLTK: Denial of Service via unauthenticated remote shutdown | fixed: 12 known affected: 8 known not affected: 1137 | 2026-09-30T16:22:12+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3352 known affected: 365 known not affected: 39262 | 2026-09-30T16:22:03+00:00 | Vulnerability · Source |
| CVE-2026-32597 | redhat_vex | pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | fixed: 1225 known affected: 17 known not affected: 2350 | 2026-09-30T16:22:01+00:00 | Vulnerability · Source |
| CVE-2026-32286 | redhat_vex | github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server | fixed: 137 known affected: 23 known not affected: 515 | 2026-09-30T16:21:53+00:00 | Vulnerability · Source |
| CVE-2026-32274 | redhat_vex | black: Black: Arbitrary file writes from unsanitized user input in cache file name | fixed: 55 known affected: 7 known not affected: 611 | 2026-09-30T16:21:51+00:00 | Vulnerability · Source |
| CVE-2026-31230 | redhat_vex | adversarial-robustness-toolbox: Adversarial Robustness Toolbox: Arbitrary Code Execution via Command-Line Argument Injection | fixed: 4 known not affected: 234 | 2026-09-30T16:21:45+00:00 | Vulnerability · Source |
| CVE-2026-28500 | redhat_vex | onnx: ONNX: Untrusted Model Repository Warnings Suppressed | fixed: 54 known affected: 1 known not affected: 389 | 2026-09-30T16:21:39+00:00 | Vulnerability · Source |
| CVE-2026-28356 | redhat_vex | multipart: denial of service via maliciously crafted HTTP or multipart segment headers | fixed: 19 known affected: 18 known not affected: 902 | 2026-09-30T16:21:31+00:00 | Vulnerability · Source |
| CVE-2026-27893 | redhat_vex | vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting | fixed: 27 known affected: 6 known not affected: 1114 | 2026-09-30T16:21:28+00:00 | Vulnerability · Source |
| CVE-2026-27489 | redhat_vex | onnx: ONNX: Information Disclosure via Path Traversal Vulnerability | fixed: 28 known affected: 1 known not affected: 415 | 2026-09-30T16:21:21+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 1345 known affected: 178 known not affected: 13996 | 2026-09-30T16:21:13+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1332 known affected: 240 known not affected: 8613 | 2026-09-30T16:21:09+00:00 | Vulnerability · Source |
| CVE-2026-23490 | redhat_vex | pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID | fixed: 1864 known affected: 23 known not affected: 6740 | 2026-09-30T16:21:01+00:00 | Vulnerability · Source |
| CVE-2026-18951 | redhat_vex | odh-training-operator-rhel9: [Trainer v2 Security] TRN-02: RHOAI overlay aggregates trainjobs CRUD into standard edit ClusterRole | fixed: 16 known not affected: 773 | 2026-09-30T16:20:55+00:00 | Vulnerability · Source |