VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
318914 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-126062 | redhat_vex | nokogiri: nokogiri: Server-Side Request Forgery via network restriction bypass on JRuby | known affected: 5 | 2026-11-11T00:27:37+00:00 | Vulnerability · Source |
| CVE-2026-77205 | redhat_vex | libreswan: Denial of Service via sending bogus X.509 certificates | fixed: 30 known affected: 2 known not affected: 9 | 2026-11-11T00:18:24+00:00 | Vulnerability · Source |
| CVE-2026-77207 | redhat_vex | libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS | fixed: 81 known affected: 2 known not affected: 3 | 2026-11-11T00:18:21+00:00 | Vulnerability · Source |
| CVE-2026-77206 | redhat_vex | libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code | fixed: 64 known affected: 3 known not affected: 3 | 2026-11-11T00:18:16+00:00 | Vulnerability · Source |
| CVE-2026-94453 | redhat_vex | libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP | fixed: 81 known affected: 5 | 2026-11-11T00:16:49+00:00 | Vulnerability · Source |
| CVE-2026-125333 | redhat_vex | node-forge: node-forge: Denial of Service via inefficient regular expression in HTTP header parsing | known affected: 44 known not affected: 32 | 2026-11-11T00:16:37+00:00 | Vulnerability · Source |
| CVE-2026-33818 | redhat_vex | encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | fixed: 8584 known affected: 262 known not affected: 4877 | 2026-11-11T00:16:35+00:00 | Vulnerability · Source |
| CVE-2026-77299 | redhat_vex | github.com/dlclark/regexp2: regexp2: Denial of Service via unbounded memory allocation during pattern matching | known affected: 4 known not affected: 10 under investigation: 102 | 2026-11-11T00:16:35+00:00 | Vulnerability · Source |
| CVE-2026-94440 | redhat_vex | net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing | fixed: 792 known affected: 194 known not affected: 209 under investigation: 11 | 2026-11-10T23:58:14+00:00 | Vulnerability · Source |
| CVE-2026-89843 | redhat_vex | kernel: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak | known affected: 203 | 2026-11-10T23:58:10+00:00 | Vulnerability · Source |
| CVE-2026-97031 | redhat_vex | crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | fixed: 1134 known affected: 221 known not affected: 286 | 2026-11-10T23:57:58+00:00 | Vulnerability · Source |
| CVE-2026-84445 | redhat_vex | google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests | fixed: 1140 known affected: 633 known not affected: 4088 | 2026-11-10T23:57:53+00:00 | Vulnerability · Source |
| CVE-2026-78669 | redhat_vex | net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | fixed: 1274 known affected: 258 known not affected: 272 | 2026-11-10T23:57:53+00:00 | Vulnerability · Source |
| CVE-2026-78667 | redhat_vex | net/http: golang: golang: Denial of Service via crafted HTTP Range headers | fixed: 1509 known affected: 217 known not affected: 318 under investigation: 67 | 2026-11-10T23:57:53+00:00 | Vulnerability · Source |
| CVE-2026-66807 | redhat_vex | console: dangerouslySetInnerHTML with unescaped subscription identifiers in SharedResourceWarning | known affected: 2 | 2026-11-10T23:49:40+00:00 | Vulnerability · Source |
| CVE-2026-125332 | redhat_vex | node-forge: node-forge: Denial of Service via unsupported TLS ServerHello compression method | known affected: 44 known not affected: 32 | 2026-11-10T23:45:54+00:00 | Vulnerability · Source |
| CVE-2026-123084 | redhat_vex | python-pulpcore: pulpcore: Header content guard jq filter exposes the content-app environment | known affected: 9 known not affected: 7 | 2026-11-10T23:45:52+00:00 | Vulnerability · Source |
| CVE-2026-106558 | redhat_vex | @backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node: Arbitrary code execution via improper markdown extension configuration | known affected: 3 | 2026-11-10T23:45:46+00:00 | Vulnerability · Source |
| CVE-2026-39834 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write | fixed: 204 known affected: 185 known not affected: 1225 | 2026-11-10T23:45:36+00:00 | Vulnerability · Source |
| CVE-2026-88031 | redhat_vex | go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs | fixed: 237 known affected: 137 known not affected: 1458 under investigation: 8 | 2026-11-10T23:45:31+00:00 | Vulnerability · Source |
| CVE-2026-66805 | redhat_vex | console: Stored DOM XSS via unescaped pod logs in document.write | fixed: 48 known not affected: 1752 | 2026-11-10T23:45:27+00:00 | Vulnerability · Source |
| CVE-2026-66798 | redhat_vex | cluster-backup-operator: cluster-backup-operator: Restore.spec.hooks passed verbatim to Velero Restore — arbitrary command execution in restored pods | fixed: 24 known not affected: 1048 | 2026-11-10T23:45:18+00:00 | Vulnerability · Source |
| CVE-2026-66138 | redhat_vex | ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration | fixed: 18 known affected: 8 known not affected: 5874 | 2026-11-10T23:45:15+00:00 | Vulnerability · Source |
| CVE-2026-56862 | redhat_vex | crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | fixed: 8718 known affected: 180 known not affected: 5260 | 2026-11-10T23:45:09+00:00 | Vulnerability · Source |
| CVE-2026-56859 | redhat_vex | encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | fixed: 8121 known affected: 156 known not affected: 5405 | 2026-11-10T23:44:59+00:00 | Vulnerability · Source |
| CVE-2026-23074 | redhat_vex | kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation | fixed: 604 known not affected: 110 | 2026-11-10T23:44:58+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1429 known affected: 219 known not affected: 10160 | 2026-11-10T23:44:58+00:00 | Vulnerability · Source |
| CVE-2026-93827 | redhat_vex | kernel: virtio-fs: avoid double-free on failed queue setup | fixed: 623 known not affected: 112 | 2026-11-10T23:38:04+00:00 | Vulnerability · Source |
| CVE-2026-89970 | redhat_vex | kernel: nvmet-auth: Synchronize timeout work during SQ teardown | fixed: 623 known affected: 22 known not affected: 90 | 2026-11-10T23:38:04+00:00 | Vulnerability · Source |
| CVE-2026-42502 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering | fixed: 938 known affected: 554 known not affected: 7639 | 2026-11-10T23:16:47+00:00 | Vulnerability · Source |
| CVE-2026-42496 | redhat_vex | perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access | fixed: 800 known affected: 2 | 2026-11-10T23:14:24+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 1501 known affected: 179 known not affected: 18053 | 2026-11-10T23:14:24+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 8213 known affected: 412 known not affected: 5395 | 2026-11-10T23:13:31+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 11222 known affected: 412 known not affected: 17319 | 2026-11-10T23:13:20+00:00 | Vulnerability · Source |
| CVE-2026-106510 | redhat_vex | plugin-techdocs-node: plugin-techdocs-node: Arbitrary code execution via crafted mkdocs configuration | known affected: 3 | 2026-11-10T23:13:08+00:00 | Vulnerability · Source |
| CVE-2026-97425 | redhat_vex | kernel: drm/amdgpu: fix buffer overflow during vBIOS update | known affected: 158 known not affected: 42 | 2026-11-10T23:12:59+00:00 | Vulnerability · Source |
| CVE-2026-93813 | redhat_vex | kernel: btrfs: tree-checker: validate INODE_REF's namelen | known affected: 1 known not affected: 199 | 2026-11-10T23:12:56+00:00 | Vulnerability · Source |
| CVE-2026-93787 | redhat_vex | kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir | fixed: 773 known affected: 22 known not affected: 42 | 2026-11-10T23:12:53+00:00 | Vulnerability · Source |
| CVE-2026-90255 | redhat_vex | kernel: Bluetooth: hci_conn: fix the SCO setup context lifetime | known affected: 124 known not affected: 79 | 2026-11-10T23:12:47+00:00 | Vulnerability · Source |
| CVE-2026-89758 | redhat_vex | kernel: mm/mempolicy: skip non-present PMDs when queueing folios | known affected: 15 known not affected: 188 | 2026-11-10T23:12:45+00:00 | Vulnerability · Source |
| CVE-2026-112902 | redhat_vex | Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags | fixed: 10 known affected: 83 known not affected: 14 | 2026-11-10T23:12:39+00:00 | Vulnerability · Source |
| CVE-2025-68121 | redhat_vex | crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | fixed: 8465 known affected: 189 known not affected: 9036 under investigation: 37 | 2026-11-10T22:49:16+00:00 | Vulnerability · Source |
| CVE-2026-21441 | redhat_vex | urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) | fixed: 1957 known affected: 386 known not affected: 3027 under investigation: 1 | 2026-11-10T22:48:12+00:00 | Vulnerability · Source |
| CVE-2025-37890 | redhat_vex | kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc | fixed: 1854 known affected: 22 known not affected: 42 | 2026-11-10T22:47:12+00:00 | Vulnerability · Source |
| CVE-2025-21864 | redhat_vex | kernel: tcp: drop secpath at the same time as we currently drop dst | fixed: 612 known affected: 42 known not affected: 48 | 2026-11-10T22:47:06+00:00 | Vulnerability · Source |
| CVE-2026-109619 | redhat_vex | php: fatal error handling retains stale request state leading to use-after-free | fixed: 4250 known affected: 28 known not affected: 151 | 2026-11-10T22:40:51+00:00 | Vulnerability · Source |
| CVE-2026-91765 | redhat_vex | php: php: Denial of Service via unbounded recursion in SOAP parser | fixed: 2046 known affected: 54 known not affected: 2 | 2026-11-10T22:40:38+00:00 | Vulnerability · Source |
| CVE-2026-109618 | redhat_vex | php: OOM bailout during request parsing leads to memory corruption and RCE | fixed: 4233 known affected: 28 known not affected: 85 | 2026-11-10T22:40:38+00:00 | Vulnerability · Source |
| CVE-2026-92091 | redhat_vex | jwcrypto: jwcrypto: denial of service via O(n^2) duplicate check on unbounded JWK key_ops array | fixed: 2 known affected: 36 | 2026-11-10T22:38:55+00:00 | Vulnerability · Source |
| CVE-2026-54789 | redhat_vex | mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing | fixed: 191 | 2026-11-10T22:38:09+00:00 | Vulnerability · Source |