VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
305792 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2025-12816 | redhat_vex | node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications | fixed: 460 known affected: 38 known not affected: 2169 | 2026-10-08T20:47:46+00:00 | Vulnerability · Source |
| CVE-2024-56201 | redhat_vex | jinja2: Jinja has a sandbox breakout through malicious filenames | fixed: 1161 known affected: 23 known not affected: 851 | 2026-10-08T20:47:27+00:00 | Vulnerability · Source |
| CVE-2024-48949 | redhat_vex | elliptic: Missing Validation in Elliptic's EDDSA Signature Verification | fixed: 750 known affected: 28 known not affected: 912 | 2026-10-08T20:47:22+00:00 | Vulnerability · Source |
| CVE-2024-45590 | redhat_vex | body-parser: Denial of Service Vulnerability in body-parser | fixed: 425 known affected: 35 known not affected: 913 | 2026-10-08T20:46:46+00:00 | Vulnerability · Source |
| CVE-2024-45337 | redhat_vex | golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto | fixed: 1801 known affected: 73 known not affected: 8478 | 2026-10-08T20:46:25+00:00 | Vulnerability · Source |
| CVE-2024-6345 | redhat_vex | pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools | fixed: 2527 known affected: 22 known not affected: 709 | 2026-10-08T20:46:04+00:00 | Vulnerability · Source |
| CVE-2026-55677 | redhat_vex | github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy | fixed: 234 known affected: 1 known not affected: 721 | 2026-10-08T20:45:52+00:00 | Vulnerability · Source |
| CVE-2026-6893 | redhat_vex | dracut: dracut: Root code execution via DHCP options command injection | fixed: 286 known affected: 1 known not affected: 230 | 2026-10-08T20:45:47+00:00 | Vulnerability · Source |
| CVE-2026-64531 | redhat_vex | kernel: net: openvswitch: reject oversized nested action attrs | fixed: 1145 known not affected: 91 | 2026-10-08T20:45:39+00:00 | Vulnerability · Source |
| CVE-2026-60002 | redhat_vex | openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side | fixed: 428 known not affected: 141 | 2026-10-08T20:45:27+00:00 | Vulnerability · Source |
| CVE-2026-57456 | redhat_vex | vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion | fixed: 348 known not affected: 273 | 2026-10-08T20:45:12+00:00 | Vulnerability · Source |
| CVE-2026-52858 | redhat_vex | vim: Vim: Arbitrary code execution via Python omni-completion | fixed: 343 known not affected: 273 | 2026-10-08T20:45:07+00:00 | Vulnerability · Source |
| CVE-2026-47167 | redhat_vex | vim: Vim: Arbitrary code execution via crafted step-definition patterns | fixed: 343 known not affected: 273 | 2026-10-08T20:44:50+00:00 | Vulnerability · Source |
| CVE-2026-47162 | redhat_vex | vim: Vim: Arbitrary Code Execution via crafted directory names | fixed: 343 known not affected: 273 | 2026-10-08T20:44:45+00:00 | Vulnerability · Source |
| CVE-2026-41292 | redhat_vex | unbound: Unbound: Denial of Service via excessive EDNS options | fixed: 200 known affected: 15 known not affected: 2 | 2026-10-08T20:44:33+00:00 | Vulnerability · Source |
| CVE-2026-29518 | redhat_vex | rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. | fixed: 50 known affected: 5 known not affected: 2 | 2026-10-08T20:44:26+00:00 | Vulnerability · Source |
| CVE-2026-16313 | redhat_vex | sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export | fixed: 386 known not affected: 3 | 2026-10-08T20:44:14+00:00 | Vulnerability · Source |
| CVE-2026-14474 | redhat_vex | sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation | fixed: 4162 known affected: 31 | 2026-10-08T20:43:57+00:00 | Vulnerability · Source |
| CVE-2026-1933 | redhat_vex | samba: Missing access check on reparse point operations | fixed: 3937 known affected: 59 | 2026-10-08T20:43:43+00:00 | Vulnerability · Source |
| CVE-2026-43870 | redhat_vex | apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities | fixed: 43 known affected: 20 known not affected: 455 | 2026-10-08T20:41:42+00:00 | Vulnerability · Source |
| CVE-2026-42154 | redhat_vex | github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint | fixed: 306 known affected: 42 known not affected: 7239 | 2026-10-08T20:41:18+00:00 | Vulnerability · Source |
| CVE-2026-42151 | redhat_vex | github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API | fixed: 530 known affected: 49 known not affected: 5695 | 2026-10-08T20:41:04+00:00 | Vulnerability · Source |
| CVE-2026-44432 | redhat_vex | urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | fixed: 534 known affected: 32 known not affected: 1753 | 2026-10-08T20:31:26+00:00 | Vulnerability · Source |
| CVE-2026-44244 | redhat_vex | GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration | fixed: 94 known affected: 12 known not affected: 1578 | 2026-10-08T20:31:05+00:00 | Vulnerability · Source |
| CVE-2026-42284 | redhat_vex | GitPython: GitPython: Arbitrary code execution via improper validation of clone options | fixed: 353 known affected: 11 known not affected: 1531 | 2026-10-08T20:30:41+00:00 | Vulnerability · Source |
| CVE-2026-42215 | redhat_vex | GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks | fixed: 377 known affected: 10 known not affected: 1727 | 2026-10-08T20:30:18+00:00 | Vulnerability · Source |
| CVE-2026-42044 | redhat_vex | axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget | fixed: 142 known affected: 45 known not affected: 1655 | 2026-10-08T20:29:50+00:00 | Vulnerability · Source |
| CVE-2026-12382 | redhat_vex | aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing | fixed: 9 known not affected: 653 | 2026-10-08T20:29:40+00:00 | Vulnerability · Source |
| CVE-2026-11332 | redhat_vex | ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | fixed: 152 known affected: 42 known not affected: 929 | 2026-10-08T20:29:31+00:00 | Vulnerability · Source |
| CVE-2026-8643 | redhat_vex | python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite | fixed: 211 known affected: 67 known not affected: 1823 | 2026-10-08T20:29:03+00:00 | Vulnerability · Source |
| CVE-2026-6322 | redhat_vex | fast-uri: fast-uri: URI authority bypass due to improper delimiter handling | fixed: 628 known affected: 29 known not affected: 6955 | 2026-10-08T20:28:58+00:00 | Vulnerability · Source |
| CVE-2026-6321 | redhat_vex | fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies | fixed: 672 known affected: 12 known not affected: 1216 | 2026-10-08T20:28:36+00:00 | Vulnerability · Source |
| CVE-2026-4800 | redhat_vex | lodash: lodash: Arbitrary code execution via untrusted input in template imports | fixed: 1010 known affected: 115 known not affected: 10848 | 2026-10-08T20:28:29+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1332 known affected: 246 known not affected: 8613 | 2026-10-08T20:27:49+00:00 | Vulnerability · Source |
| CVE-2026-69192 | redhat_vex | ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass | fixed: 445 known affected: 13 known not affected: 3342 | 2026-10-08T20:27:42+00:00 | Vulnerability · Source |
| CVE-2026-69152 | redhat_vex | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation | fixed: 1040 known affected: 64 known not affected: 4644 | 2026-10-08T20:27:36+00:00 | Vulnerability · Source |
| CVE-2026-14257 | redhat_vex | brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function | fixed: 505 known affected: 22 known not affected: 3652 | 2026-10-08T20:27:29+00:00 | Vulnerability · Source |
| CVE-2026-57967 | redhat_vex | artemis-server: Apache Artemis — session hijack via missing authentication | fixed: 563 known affected: 2 known not affected: 2188 | 2026-10-08T20:26:59+00:00 | Vulnerability · Source |
| CVE-2026-49364 | redhat_vex | wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof | fixed: 563 known affected: 4 known not affected: 2192 | 2026-10-08T20:26:48+00:00 | Vulnerability · Source |
| CVE-2026-49362 | redhat_vex | artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation | fixed: 563 known affected: 4 known not affected: 2191 | 2026-10-08T20:26:27+00:00 | Vulnerability · Source |
| CVE-2026-42499 | redhat_vex | net/mail: golang: net/mail: Denial of Service via pathological email address parsing | fixed: 1951 known affected: 102 known not affected: 8903 | 2026-10-08T20:19:05+00:00 | Vulnerability · Source |
| CVE-2026-39822 | redhat_vex | golang: Go os.Root: Symlink following vulnerability allows directory traversal | fixed: 445 known affected: 29 known not affected: 581 | 2026-10-08T20:18:38+00:00 | Vulnerability · Source |
| CVE-2026-39820 | redhat_vex | net/mail: golang: Go net/mail: Denial of Service via crafted email inputs | fixed: 1493 known affected: 93 known not affected: 7865 | 2026-10-08T20:18:10+00:00 | Vulnerability · Source |
| CVE-2026-33814 | redhat_vex | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | fixed: 2595 known affected: 359 known not affected: 32508 under investigation: 498 | 2026-10-08T20:17:53+00:00 | Vulnerability · Source |
| CVE-2026-15816 | redhat_vex | dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() | fixed: 269 known affected: 1 known not affected: 247 | 2026-10-08T20:17:07+00:00 | Vulnerability · Source |
| CVE-2026-33811 | redhat_vex | net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | fixed: 1856 known affected: 145 known not affected: 8327 | 2026-10-08T20:15:10+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3355 known affected: 364 known not affected: 39271 | 2026-10-08T20:14:57+00:00 | Vulnerability · Source |
| CVE-2026-12701 | redhat_vex | pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport | fixed: 32 known affected: 2 known not affected: 590 | 2026-10-08T20:14:38+00:00 | Vulnerability · Source |
| CVE-2026-59899 | redhat_vex | io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) | fixed: 475 known affected: 35 known not affected: 340 | 2026-10-08T20:14:33+00:00 | Vulnerability · Source |
| CVE-2026-56819 | redhat_vex | io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak | fixed: 30 known affected: 35 known not affected: 333 | 2026-10-08T20:14:26+00:00 | Vulnerability · Source |