VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
221670 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-47732 | redhat_vex | twig/twig: Twig: Security policy bypass leads to information disclosure | known not affected: 1 | 2026-07-15T12:24:34+00:00 | Vulnerability · Source |
| CVE-2026-8177 | redhat_vex | perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names | fixed: 39 known affected: 2 known not affected: 1 | 2026-07-15T12:23:45+00:00 | Vulnerability · Source |
| CVE-2026-34881 | redhat_vex | openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access | fixed: 3 known affected: 6 | 2026-07-15T12:23:36+00:00 | Vulnerability · Source |
| CVE-2026-42790 | redhat_vex | erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing | fixed: 30 known affected: 40 | 2026-07-15T12:20:32+00:00 | Vulnerability · Source |
| CVE-2026-42789 | redhat_vex | erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation | fixed: 30 known affected: 40 | 2026-07-15T12:20:28+00:00 | Vulnerability · Source |
| CVE-2026-43001 | redhat_vex | OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation | fixed: 3 known affected: 5 known not affected: 4 | 2026-07-15T12:11:28+00:00 | Vulnerability · Source |
| CVE-2026-27137 | redhat_vex | crypto/x509: Incorrect enforcement of email constraints in crypto/x509 | fixed: 329 known affected: 134 known not affected: 1117 | 2026-07-15T12:07:23+00:00 | Vulnerability · Source |
| CVE-2023-39325 | redhat_vex | golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) | fixed: 4761 known affected: 244 known not affected: 30354 | 2026-07-15T11:51:23+00:00 | Vulnerability · Source |
| CVE-2026-12143 | redhat_vex | form-data: form-data: Form field override via CRLF injection | fixed: 97 known affected: 50 known not affected: 157 under investigation: 108 | 2026-07-15T11:34:25+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 320 known affected: 66 known not affected: 1247 | 2026-07-15T11:34:10+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 145 known not affected: 1097 | 2026-07-15T11:33:23+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3038 known affected: 78 known not affected: 11728 | 2026-07-15T11:32:51+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2719 known affected: 54 known not affected: 6259 under investigation: 1 | 2026-07-15T11:31:38+00:00 | Vulnerability · Source |
| CVE-2025-22868 | redhat_vex | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | fixed: 1876 known affected: 95 known not affected: 8426 | 2026-07-15T11:31:06+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 653 known affected: 148 known not affected: 316 under investigation: 1 | 2026-07-15T10:36:19+00:00 | Vulnerability · Source |
| CVE-2026-42342 | redhat_vex | react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint | known affected: 148 known not affected: 26 | 2026-07-15T10:31:14+00:00 | Vulnerability · Source |
| CVE-2026-45736 | redhat_vex | ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` | fixed: 29 known affected: 58 known not affected: 383 | 2026-07-15T10:31:05+00:00 | Vulnerability · Source |
| CVE-2026-43514 | redhat_vex | tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy | fixed: 4 known affected: 28 | 2026-07-15T10:19:37+00:00 | Vulnerability · Source |
| CVE-2026-47736 | redhat_vex | puma: Puma: Denial of Service due to unbounded memory growth in PROXY protocol v1 | known not affected: 19 | 2026-07-15T10:17:11+00:00 | Vulnerability · Source |
| CVE-2026-47737 | redhat_vex | puma: Puma: Source IP spoofing via PROXY protocol header re-parsing | known not affected: 19 | 2026-07-15T10:16:31+00:00 | Vulnerability · Source |
| CVE-2026-32283 | redhat_vex | crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages | fixed: 2038 known affected: 220 known not affected: 954 under investigation: 1 | 2026-07-15T10:00:17+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 578 known affected: 191 known not affected: 484 under investigation: 4 | 2026-07-15T09:56:30+00:00 | Vulnerability · Source |
| CVE-2026-42997 | redhat_vex | OpenStack Ironic: OpenStack Ironic: Information disclosure via credential forwarding during mold import | fixed: 4 known affected: 9 known not affected: 4 | 2026-07-15T09:56:18+00:00 | Vulnerability · Source |
| CVE-2026-53486 | redhat_vex | decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction | known affected: 4 | 2026-07-15T09:46:13+00:00 | Vulnerability · Source |
| CVE-2026-35469 | redhat_vex | Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code | fixed: 404 known affected: 78 known not affected: 15464 | 2026-07-15T09:31:40+00:00 | Vulnerability · Source |
| CVE-2026-12151 | redhat_vex | undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames | fixed: 255 known affected: 53 known not affected: 110 | 2026-07-15T09:31:05+00:00 | Vulnerability · Source |
| CVE-2026-15028 | redhat_vex | libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header | fixed: 3 known affected: 21 | 2026-07-15T09:15:14+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 218 known affected: 420 known not affected: 170 under investigation: 2 | 2026-07-15T09:12:05+00:00 | Vulnerability · Source |
| CVE-2026-46579 | redhat_vex | openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend | fixed: 16 known affected: 1 known not affected: 1476 | 2026-07-15T09:09:53+00:00 | Vulnerability · Source |
| CVE-2026-26996 | redhat_vex | minimatch: minimatch: Denial of Service via specially crafted glob patterns | fixed: 520 known affected: 38 known not affected: 3848 | 2026-07-15T09:09:37+00:00 | Vulnerability · Source |
| CVE-2026-6523 | redhat_vex | wireshark: Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark | known affected: 4 known not affected: 16 | 2026-07-15T09:08:31+00:00 | Vulnerability · Source |
| CVE-2026-6525 | redhat_vex | wireshark: NULL Pointer Dereference in Wireshark | known not affected: 20 | 2026-07-15T09:08:30+00:00 | Vulnerability · Source |
| CVE-2026-9759 | redhat_vex | wireshark: NULL Pointer Dereference in Wireshark | known affected: 4 known not affected: 16 | 2026-07-15T09:07:15+00:00 | Vulnerability · Source |
| CVE-2026-5299 | redhat_vex | wireshark: Uncontrolled Recursion in Wireshark | known affected: 4 known not affected: 16 | 2026-07-15T09:07:12+00:00 | Vulnerability · Source |
| CVE-2026-10649 | redhat_vex | pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression | fixed: 268 known affected: 30 | 2026-07-15T09:06:30+00:00 | Vulnerability · Source |
| CVE-2026-46597 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs | fixed: 128 known affected: 177 known not affected: 115 under investigation: 73 | 2026-07-15T09:01:28+00:00 | Vulnerability · Source |
| CVE-2026-42586 | redhat_vex | netty-codec-redis: Netty: Command injection via CRLF characters in Redis codec encoder | fixed: 1 known affected: 4 known not affected: 2 | 2026-07-15T08:56:28+00:00 | Vulnerability · Source |
| CVE-2026-45205 | redhat_vex | commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input | known affected: 45 known not affected: 4 | 2026-07-15T08:25:57+00:00 | Vulnerability · Source |
| CVE-2026-4647 | redhat_vex | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library | fixed: 3 known affected: 39 known not affected: 34 | 2026-07-15T08:10:56+00:00 | Vulnerability · Source |
| CVE-2026-14251 | redhat_vex | gitops-operator: gitops-operator: Missing allowedNamespace check in ReconcilerHook for ClusterRole/Role cases enables potential privilege escalation and DoS | known affected: 2 | 2026-07-15T08:06:07+00:00 | Vulnerability · Source |
| CVE-2026-42264 | redhat_vex | axios: Axios: Prototype pollution allows information disclosure and request manipulation | fixed: 44 known affected: 47 known not affected: 176 | 2026-07-15T07:51:06+00:00 | Vulnerability · Source |
| CVE-2026-10846 | redhat_vex | ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching | known affected: 25 | 2026-07-15T06:55:46+00:00 | Vulnerability · Source |
| CVE-2026-44740 | redhat_vex | github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation | fixed: 112 known affected: 218 known not affected: 70 | 2026-07-15T05:51:28+00:00 | Vulnerability · Source |
| CVE-2026-12325 | redhat_vex | firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component | fixed: 260 known affected: 8 | 2026-07-15T05:48:54+00:00 | Vulnerability · Source |
| CVE-2026-12324 | redhat_vex | firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component | fixed: 260 known affected: 8 | 2026-07-15T05:48:51+00:00 | Vulnerability · Source |
| CVE-2026-39244 | redhat_vex | adm-zip: adm-zip: Denial of Service via crafted ZIP file leading to excessive memory allocation | known affected: 15 under investigation: 7 | 2026-07-15T05:48:37+00:00 | Vulnerability · Source |
| CVE-2026-12330 | redhat_vex | firefox: thunderbird: Incorrect boundary conditions in the Internationalization component | fixed: 260 known affected: 8 | 2026-07-15T05:47:54+00:00 | Vulnerability · Source |
| CVE-2026-12327 | redhat_vex | firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | fixed: 260 known affected: 8 | 2026-07-15T05:47:51+00:00 | Vulnerability · Source |
| CVE-2026-12315 | redhat_vex | firefox: thunderbird: Mitigation bypass in the DOM: Security component | fixed: 260 known affected: 8 | 2026-07-15T05:47:48+00:00 | Vulnerability · Source |
| CVE-2026-12314 | redhat_vex | firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 | fixed: 260 known affected: 8 | 2026-07-15T05:47:47+00:00 | Vulnerability · Source |