VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
303552 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-79675 | redhat_vex | nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options | fixed: 2 known affected: 13 known not affected: 234 | 2026-09-30T16:31:46+00:00 | Vulnerability · Source |
| CVE-2026-79674 | redhat_vex | nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors | fixed: 6 known affected: 11 known not affected: 605 | 2026-09-30T16:31:45+00:00 | Vulnerability · Source |
| CVE-2026-78682 | redhat_vex | nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration | fixed: 2 known affected: 14 known not affected: 233 | 2026-09-30T16:31:38+00:00 | Vulnerability · Source |
| CVE-2026-73417 | redhat_vex | jupyterlab: JupyterLab: Cross-site scripting (XSS) allows arbitrary code execution | fixed: 41 known affected: 9 known not affected: 405 | 2026-09-30T16:31:35+00:00 | Vulnerability · Source |
| CVE-2026-73415 | redhat_vex | jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer | fixed: 47 known affected: 5 known not affected: 398 | 2026-09-30T16:31:26+00:00 | Vulnerability · Source |
| CVE-2026-73089 | redhat_vex | browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results | fixed: 118 known affected: 42 known not affected: 1213 | 2026-09-30T16:31:18+00:00 | Vulnerability · Source |
| CVE-2026-71281 | redhat_vex | peft: peft: Arbitrary Code Execution via Unsafe Deserialization in LoRA-GA and CorDA Modules | fixed: 8 known affected: 20 known not affected: 437 | 2026-09-30T16:31:13+00:00 | Vulnerability · Source |
| CVE-2026-69244 | redhat_vex | aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses | fixed: 272 known affected: 58 known not affected: 1985 | 2026-09-30T16:31:08+00:00 | Vulnerability · Source |
| CVE-2026-69192 | redhat_vex | ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass | fixed: 445 known affected: 13 known not affected: 3342 | 2026-09-30T16:31:02+00:00 | Vulnerability · Source |
| CVE-2026-69152 | redhat_vex | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation | fixed: 990 known affected: 62 known not affected: 4457 | 2026-09-30T16:31:00+00:00 | Vulnerability · Source |
| CVE-2026-68770 | redhat_vex | sentence-transformers: sentence-transformers: Remote Code Execution via Security Control Bypass | fixed: 2 known affected: 13 known not affected: 237 | 2026-09-30T16:30:52+00:00 | Vulnerability · Source |
| CVE-2026-67325 | redhat_vex | gitpython: GitPython: Command Injection via Git option prefix abbreviation | fixed: 96 known affected: 21 known not affected: 1370 | 2026-09-30T16:30:45+00:00 | Vulnerability · Source |
| CVE-2026-67323 | redhat_vex | gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options | fixed: 98 known affected: 24 known not affected: 1147 | 2026-09-30T16:30:38+00:00 | Vulnerability · Source |
| CVE-2026-67322 | redhat_vex | gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL | fixed: 96 known affected: 23 known not affected: 1151 | 2026-09-30T16:30:36+00:00 | Vulnerability · Source |
| CVE-2026-66040 | redhat_vex | ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image | fixed: 1 known affected: 7 known not affected: 234 | 2026-09-30T16:30:31+00:00 | Vulnerability · Source |
| CVE-2026-66036 | redhat_vex | ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter | fixed: 470 known affected: 6 known not affected: 442 | 2026-09-30T16:30:25+00:00 | Vulnerability · Source |
| CVE-2026-64835 | redhat_vex | FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files | fixed: 403 known affected: 17 known not affected: 561 | 2026-09-30T16:30:20+00:00 | Vulnerability · Source |
| CVE-2026-64834 | redhat_vex | FFmpeg: Denial of Service via crafted RTP/ASF stream | fixed: 469 known affected: 6 known not affected: 234 | 2026-09-30T16:30:16+00:00 | Vulnerability · Source |
| CVE-2026-63310 | redhat_vex | nltk: NLTK before 3.9.3 Missing Post-Download Integrity Verification | fixed: 2 known affected: 4 known not affected: 243 | 2026-09-30T16:30:12+00:00 | Vulnerability · Source |
| CVE-2026-62384 | redhat_vex | nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass | fixed: 6 known affected: 11 known not affected: 605 | 2026-09-30T16:30:06+00:00 | Vulnerability · Source |
| CVE-2026-59886 | redhat_vex | pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values | fixed: 1295 known affected: 116 known not affected: 1703 | 2026-09-30T16:30:02+00:00 | Vulnerability · Source |
| CVE-2026-59885 | redhat_vex | pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER | fixed: 96 known affected: 100 known not affected: 1206 | 2026-09-30T16:29:58+00:00 | Vulnerability · Source |
| CVE-2026-59874 | redhat_vex | tar: Node-tar: Denial of Service via malformed tar archive header | fixed: 418 known affected: 46 known not affected: 893 | 2026-09-30T16:29:49+00:00 | Vulnerability · Source |
| CVE-2026-59873 | redhat_vex | tar: node-tar: Denial of Service via crafted gzip bomb | fixed: 422 known affected: 46 known not affected: 2853 | 2026-09-30T16:29:46+00:00 | Vulnerability · Source |
| CVE-2026-59869 | redhat_vex | js-yaml: js-yaml: Denial of Service via crafted YAML documents | fixed: 569 known affected: 74 known not affected: 11253 | 2026-09-30T16:29:42+00:00 | Vulnerability · Source |
| CVE-2026-59205 | redhat_vex | Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API | fixed: 107 known affected: 17 known not affected: 662 | 2026-09-30T16:29:33+00:00 | Vulnerability · Source |
| CVE-2026-59204 | redhat_vex | Pillow: Pillow: Denial of Service via crafted JPEG2000 image | fixed: 109 known affected: 17 known not affected: 660 | 2026-09-30T16:29:20+00:00 | Vulnerability · Source |
| CVE-2026-59200 | redhat_vex | Pillow: Pillow: Denial of service via crafted PDF stream | fixed: 104 known affected: 16 known not affected: 661 | 2026-09-30T16:29:08+00:00 | Vulnerability · Source |
| CVE-2026-59199 | redhat_vex | Pillow: Pillow: Denial of Service via out-of-bounds write in image processing | fixed: 104 known affected: 16 known not affected: 661 | 2026-09-30T16:28:54+00:00 | Vulnerability · Source |
| CVE-2026-59197 | redhat_vex | Pillow: Pillow: Native heap out-of-bounds write | fixed: 240 known affected: 24 known not affected: 1267 | 2026-09-30T16:28:37+00:00 | Vulnerability · Source |
| CVE-2026-55969 | redhat_vex | thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound | fixed: 136 known affected: 28 known not affected: 1609 | 2026-09-30T16:27:50+00:00 | Vulnerability · Source |
| CVE-2026-54283 | redhat_vex | starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | fixed: 78 known affected: 28 known not affected: 897 | 2026-09-30T16:27:43+00:00 | Vulnerability · Source |
| CVE-2026-54058 | redhat_vex | Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image | fixed: 199 known affected: 21 known not affected: 827 | 2026-09-30T16:27:38+00:00 | Vulnerability · Source |
| CVE-2026-49855 | redhat_vex | tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption | fixed: 28 known affected: 46 known not affected: 254 | 2026-09-30T16:27:34+00:00 | Vulnerability · Source |
| CVE-2026-48779 | redhat_vex | ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments | fixed: 613 known affected: 39 known not affected: 1178 | 2026-09-30T16:27:31+00:00 | Vulnerability · Source |
| CVE-2026-48746 | redhat_vex | vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access | fixed: 40 known affected: 37 known not affected: 652 | 2026-09-30T16:27:26+00:00 | Vulnerability · Source |
| CVE-2026-48710 | redhat_vex | starlette: Starlette: Security restriction bypass via malformed HTTP Host header | fixed: 109 known affected: 30 known not affected: 1179 | 2026-09-30T16:27:13+00:00 | Vulnerability · Source |
| CVE-2026-48586 | redhat_vex | thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data | fixed: 155 known affected: 28 known not affected: 1833 | 2026-09-30T16:27:04+00:00 | Vulnerability · Source |
| CVE-2026-48526 | redhat_vex | python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens | fixed: 998 known affected: 19 known not affected: 2291 | 2026-09-30T16:26:59+00:00 | Vulnerability · Source |
| CVE-2026-46595 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation | fixed: 307 known affected: 58 known not affected: 2269 | 2026-09-30T16:26:54+00:00 | Vulnerability · Source |
| CVE-2026-45736 | redhat_vex | ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` | fixed: 435 known affected: 40 known not affected: 5116 | 2026-09-30T16:26:49+00:00 | Vulnerability · Source |
| CVE-2026-44843 | redhat_vex | langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization | fixed: 14 known affected: 10 known not affected: 569 | 2026-09-30T16:26:44+00:00 | Vulnerability · Source |
| CVE-2026-44727 | redhat_vex | jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers | fixed: 48 known not affected: 537 | 2026-09-30T16:26:40+00:00 | Vulnerability · Source |
| CVE-2026-44432 | redhat_vex | urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | fixed: 269 known affected: 29 known not affected: 1726 | 2026-09-30T16:26:24+00:00 | Vulnerability · Source |
| CVE-2026-44240 | redhat_vex | basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses | fixed: 13 known affected: 2 known not affected: 1442 | 2026-09-30T16:26:21+00:00 | Vulnerability · Source |
| CVE-2026-42508 | redhat_vex | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey | fixed: 1073 known affected: 50 known not affected: 2407 | 2026-09-30T16:26:07+00:00 | Vulnerability · Source |
| CVE-2026-42338 | redhat_vex | ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input | fixed: 508 known affected: 11 known not affected: 2965 | 2026-09-30T16:26:02+00:00 | Vulnerability · Source |
| CVE-2026-42297 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Unauthorized ConfigMap manipulation due to missing authorization | fixed: 6 known not affected: 231 | 2026-09-30T16:25:58+00:00 | Vulnerability · Source |
| CVE-2026-42296 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Privilege escalation via security control bypass | fixed: 21 known not affected: 214 | 2026-09-30T16:25:52+00:00 | Vulnerability · Source |
| CVE-2026-42294 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor | fixed: 6 known not affected: 229 | 2026-09-30T16:25:47+00:00 | Vulnerability · Source |