VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
304156 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-69896 | microsoft_vex | Windows Error Reporting Elevation of Privilege Vulnerability | fixed: 8 known affected: 8 | 2026-10-13T07:00:00+00:00 | Vulnerability · Source |
| CVE-2025-14928 | redhat_vex | transformers: code execution when converting a malicious HuBERT model checkpoint | fixed: 40 known affected: 29 known not affected: 636 | 2026-10-02T01:46:28+00:00 | Vulnerability · Source |
| CVE-2026-33814 | redhat_vex | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | fixed: 2322 known affected: 383 known not affected: 27853 under investigation: 496 | 2026-10-02T01:37:11+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 1345 known affected: 178 known not affected: 13996 | 2026-10-02T01:34:53+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3352 known affected: 364 known not affected: 39263 | 2026-10-02T01:34:44+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2999 known affected: 144 known not affected: 16904 | 2026-10-02T01:34:37+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1332 known affected: 240 known not affected: 8613 | 2026-10-02T01:33:40+00:00 | Vulnerability · Source |
| CVE-2026-27145 | redhat_vex | crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | fixed: 1083 known affected: 74 known not affected: 5346 | 2026-10-02T01:33:27+00:00 | Vulnerability · Source |
| CVE-2026-33818 | redhat_vex | encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | fixed: 7119 known affected: 200 known not affected: 2918 | 2026-10-02T01:33:05+00:00 | Vulnerability · Source |
| CVE-2026-33811 | redhat_vex | net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | fixed: 1835 known affected: 138 known not affected: 8314 | 2026-10-02T01:32:18+00:00 | Vulnerability · Source |
| CVE-2026-41178 | redhat_vex | github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers | fixed: 1079 known affected: 213 known not affected: 6389 | 2026-10-02T01:29:49+00:00 | Vulnerability · Source |
| CVE-2026-44740 | redhat_vex | github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation | fixed: 525 known affected: 100 known not affected: 2311 | 2026-10-02T01:29:04+00:00 | Vulnerability · Source |
| CVE-2026-56860 | redhat_vex | net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | fixed: 7197 known affected: 276 known not affected: 3531 | 2026-10-02T01:25:19+00:00 | Vulnerability · Source |
| CVE-2026-56858 | redhat_vex | html/template: golang: Go html/template: Cross-Site Scripting via pathological input | fixed: 6645 known affected: 215 known not affected: 3242 | 2026-10-02T01:25:11+00:00 | Vulnerability · Source |
| CVE-2026-56859 | redhat_vex | encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | fixed: 6716 known affected: 248 known not affected: 3453 | 2026-10-02T01:24:30+00:00 | Vulnerability · Source |
| CVE-2026-103923 | redhat_vex | katex: katex: Cross-site scripting via prototype pollution inheritance | known affected: 3 known not affected: 1 | 2026-10-02T01:17:34+00:00 | Vulnerability · Source |
| CVE-2026-104056 | redhat_vex | authlib: authlib: Information disclosure via unvalidated discovery metadata | known affected: 11 known not affected: 1 | 2026-10-02T01:15:11+00:00 | Vulnerability · Source |
| CVE-2026-74586 | redhat_vex | kernel: sctp: clear new_transport when removing a peer | known affected: 260 known not affected: 14 | 2026-10-02T01:15:08+00:00 | Vulnerability · Source |
| CVE-2026-73637 | redhat_vex | httpd: httpd: Authentication state corruption via concurrent Digest authentication requests | known affected: 54 | 2026-10-02T01:15:06+00:00 | Vulnerability · Source |
| CVE-2026-69097 | redhat_vex | gitpython: GitPython: Remote Code Execution via Config Injection in Submodule Names | known affected: 41 known not affected: 37 | 2026-10-02T01:15:03+00:00 | Vulnerability · Source |
| CVE-2026-68263 | redhat_vex | kernel: Linux kernel: drm/imagination use-after-free vulnerability | known affected: 1 known not affected: 274 | 2026-10-02T01:15:01+00:00 | Vulnerability · Source |
| CVE-2026-64041 | redhat_vex | kernel: ASoC: codecs: fs210x: fix possible buffer overflow | known not affected: 274 | 2026-10-02T01:14:58+00:00 | Vulnerability · Source |
| CVE-2026-63045 | redhat_vex | httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response | known affected: 54 | 2026-10-02T01:14:56+00:00 | Vulnerability · Source |
| CVE-2026-58415 | redhat_vex | httpd: httpd: Information disclosure via direct request to the WebDAV state directory | known affected: 54 | 2026-10-02T01:14:54+00:00 | Vulnerability · Source |
| CVE-2026-56098 | redhat_vex | rubygem-katello: improper authorization logic allows resource enumeration | fixed: 8 known affected: 8 known not affected: 252 | 2026-10-02T01:14:52+00:00 | Vulnerability · Source |
| CVE-2026-56097 | redhat_vex | rubygem-katello: SQL injection in Registry Proxy via labels | fixed: 8 known affected: 8 known not affected: 252 | 2026-10-02T01:14:50+00:00 | Vulnerability · Source |
| CVE-2026-53384 | redhat_vex | kernel: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails | known affected: 200 known not affected: 74 | 2026-10-02T01:14:46+00:00 | Vulnerability · Source |
| CVE-2026-42528 | redhat_vex | httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error | known affected: 54 | 2026-10-02T01:14:43+00:00 | Vulnerability · Source |
| CVE-2026-12545 | redhat_vex | rubygem-hammer_cli: command injection via insecure editor invocation | fixed: 16 known affected: 1 known not affected: 244 | 2026-10-02T01:14:42+00:00 | Vulnerability · Source |
| CVE-2026-12542 | redhat_vex | foreman: command injection in foreman-tail | fixed: 82 known affected: 17 known not affected: 178 | 2026-10-02T01:14:41+00:00 | Vulnerability · Source |
| CVE-2025-68357 | redhat_vex | kernel: iomap: allocate s_dio_done_wq for async reads as well | known affected: 18 known not affected: 256 | 2026-10-02T01:14:38+00:00 | Vulnerability · Source |
| CVE-2021-47449 | redhat_vex | kernel: ice: fix locking for Tx timestamp tracking flush | known affected: 92 known not affected: 106 | 2026-10-02T01:14:36+00:00 | Vulnerability · Source |
| CVE-2025-38078 | redhat_vex | kernel: Linux kernel: Use-After-Free vulnerability in PCM OSS layer due to race condition | known affected: 60 known not affected: 214 | 2026-10-02T01:14:36+00:00 | Vulnerability · Source |
| CVE-2025-66471 | redhat_vex | urllib3: urllib3 Streaming API improperly handles highly compressed data | fixed: 1965 known affected: 126 known not affected: 3875 | 2026-10-02T01:06:25+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1992 known affected: 379 known not affected: 2959 | 2026-10-02T01:06:14+00:00 | Vulnerability · Source |
| CVE-2026-55856 | redhat_vex | org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake | known affected: 48 known not affected: 75 | 2026-10-02T01:05:58+00:00 | Vulnerability · Source |
| CVE-2026-47261 | redhat_vex | wasmtime-wasi: Wasmtime: Wasmtime: Access control bypass allows unauthorized file truncation via specific open flags. | known affected: 2 known not affected: 1 | 2026-10-02T01:05:52+00:00 | Vulnerability · Source |
| CVE-2026-42502 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering | fixed: 788 known affected: 239 known not affected: 5661 | 2026-10-02T01:05:48+00:00 | Vulnerability · Source |
| CVE-2026-19032 | redhat_vex | com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization | known affected: 285 known not affected: 1 | 2026-10-02T01:05:46+00:00 | Vulnerability · Source |
| CVE-2026-68494 | redhat_vex | com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser | fixed: 857 known affected: 235 known not affected: 2892 | 2026-10-02T01:03:47+00:00 | Vulnerability · Source |
| CVE-2026-63718 | redhat_vex | httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi | known affected: 54 | 2026-10-02T01:03:42+00:00 | Vulnerability · Source |
| CVE-2026-15911 | redhat_vex | confluent-kafka: confluent-kafka: Information disclosure via improper TLS certificate validation in HashiCorp Vault integration | known affected: 5 | 2026-10-02T01:03:41+00:00 | Vulnerability · Source |
| CVE-2026-103484 | redhat_vex | pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build | known affected: 4 | 2026-10-02T00:53:23+00:00 | Vulnerability · Source |
| CVE-2026-96659 | redhat_vex | foreman: Excessive Permissions for Viewer Role on Preview | fixed: 82 known not affected: 178 | 2026-10-02T00:53:18+00:00 | Vulnerability · Source |
| CVE-2026-96658 | redhat_vex | foreman: Safemode Bypass leading to RCE | fixed: 26 known not affected: 234 | 2026-10-02T00:53:13+00:00 | Vulnerability · Source |
| CVE-2026-73636 | redhat_vex | httpd: httpd: Authentication bypass via credential replay in mod_auth_digest | known affected: 54 | 2026-10-02T00:53:09+00:00 | Vulnerability · Source |
| CVE-2026-63686 | redhat_vex | httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc | known affected: 54 | 2026-10-02T00:53:07+00:00 | Vulnerability · Source |
| CVE-2026-63292 | redhat_vex | httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias | known affected: 54 | 2026-10-02T00:52:57+00:00 | Vulnerability · Source |
| CVE-2026-59685 | redhat_vex | httpd: httpd: Denial of Service via out-of-bounds write during Windows path expansion | known affected: 54 | 2026-10-02T00:52:54+00:00 | Vulnerability · Source |
| CVE-2026-56153 | redhat_vex | httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite | known affected: 54 | 2026-10-02T00:52:34+00:00 | Vulnerability · Source |