VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
289293 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-1784 | redhat_vex | ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection | fixed: 29 known not affected: 4787 | 2026-08-18T22:06:00+00:00 | Vulnerability · Source |
| CVE-2026-42154 | redhat_vex | github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint | fixed: 240 known affected: 39 known not affected: 4524 | 2026-08-18T22:04:47+00:00 | Vulnerability · Source |
| CVE-2026-16242 | redhat_vex | hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates | fixed: 52 known affected: 3 known not affected: 4088 | 2026-08-18T22:04:18+00:00 | Vulnerability · Source |
| CVE-2026-13676 | redhat_vex | fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization | fixed: 75 known affected: 69 known not affected: 4141 | 2026-08-18T22:03:57+00:00 | Vulnerability · Source |
| CVE-2026-46579 | redhat_vex | openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend | fixed: 38 known not affected: 5146 | 2026-08-18T22:02:39+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2403 known affected: 160 known not affected: 12424 under investigation: 1 | 2026-08-18T22:02:22+00:00 | Vulnerability · Source |
| CVE-2026-29063 | redhat_vex | immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution | fixed: 498 known affected: 34 known not affected: 12737 | 2026-08-18T22:01:47+00:00 | Vulnerability · Source |
| CVE-2025-61731 | redhat_vex | cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive | fixed: 5320 known affected: 10 known not affected: 761 | 2026-08-18T22:01:02+00:00 | Vulnerability · Source |
| CVE-2025-61732 | redhat_vex | cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy | fixed: 5141 known affected: 3 known not affected: 985 | 2026-08-18T22:00:10+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 975 known affected: 115 known not affected: 1122 under investigation: 3 | 2026-08-18T21:59:46+00:00 | Vulnerability · Source |
| CVE-2026-59873 | redhat_vex | tar: node-tar: Denial of Service via crafted gzip bomb | fixed: 358 known affected: 61 known not affected: 2068 | 2026-08-18T21:59:35+00:00 | Vulnerability · Source |
| CVE-2026-59869 | redhat_vex | js-yaml: js-yaml: Denial of Service via crafted YAML documents | fixed: 151 known affected: 65 known not affected: 3134 under investigation: 90 | 2026-08-18T21:59:31+00:00 | Vulnerability · Source |
| CVE-2026-42338 | redhat_vex | ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input | fixed: 375 known affected: 16 known not affected: 2194 | 2026-08-18T21:59:07+00:00 | Vulnerability · Source |
| CVE-2026-35469 | redhat_vex | Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code | fixed: 492 known affected: 59 known not affected: 22660 | 2026-08-18T21:58:57+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 569 known affected: 258 known not affected: 3422 | 2026-08-18T21:58:40+00:00 | Vulnerability · Source |
| CVE-2026-9277 | redhat_vex | shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators | fixed: 137 known affected: 21 known not affected: 4847 | 2026-08-18T21:58:20+00:00 | Vulnerability · Source |
| CVE-2026-44293 | redhat_vex | protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors | fixed: 29 known affected: 19 known not affected: 2160 | 2026-08-18T21:51:49+00:00 | Vulnerability · Source |
| CVE-2026-6322 | redhat_vex | fast-uri: fast-uri: URI authority bypass due to improper delimiter handling | fixed: 139 known affected: 49 known not affected: 5254 | 2026-08-18T21:51:01+00:00 | Vulnerability · Source |
| CVE-2026-4800 | redhat_vex | lodash: lodash: Arbitrary code execution via untrusted input in template imports | fixed: 976 known affected: 115 known not affected: 7794 under investigation: 1 | 2026-08-18T21:50:43+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 10584 known affected: 442 known not affected: 17198 | 2026-08-18T21:49:42+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 2993 known affected: 381 known not affected: 35944 | 2026-08-18T21:47:45+00:00 | Vulnerability · Source |
| CVE-2024-34155 | redhat_vex | go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion | fixed: 4833 known affected: 61 known not affected: 2308 | 2026-08-18T21:44:59+00:00 | Vulnerability · Source |
| CVE-2024-30255 | redhat_vex | envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood | fixed: 53 known affected: 15 known not affected: 24 | 2026-08-18T21:44:53+00:00 | Vulnerability · Source |
| CVE-2024-28180 | redhat_vex | jose-go: improper handling of highly compressed data | fixed: 1855 known affected: 94 known not affected: 14547 | 2026-08-18T21:44:48+00:00 | Vulnerability · Source |
| CVE-2024-28176 | redhat_vex | jose: resource exhaustion | fixed: 604 known affected: 3 known not affected: 2422 | 2026-08-18T21:44:36+00:00 | Vulnerability · Source |
| CVE-2023-45287 | redhat_vex | golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. | fixed: 958 known affected: 72 known not affected: 717 under investigation: 1 | 2026-08-18T21:44:36+00:00 | Vulnerability · Source |
| CVE-2026-32282 | redhat_vex | golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root | fixed: 1436 known affected: 173 known not affected: 2176 | 2026-08-18T21:43:46+00:00 | Vulnerability · Source |
| CVE-2026-72317 | redhat_vex | kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker | known affected: 198 known not affected: 76 | 2026-08-18T21:43:41+00:00 | Vulnerability · Source |
| CVE-2026-72312 | redhat_vex | kernel: octeontx2-af: fix VF bringup affecting PF promiscuous state | known affected: 184 known not affected: 90 | 2026-08-18T21:43:36+00:00 | Vulnerability · Source |
| CVE-2026-72311 | redhat_vex | kernel: drm/xe: free madvise VMA array on L2 flush failure | known not affected: 274 | 2026-08-18T21:43:30+00:00 | Vulnerability · Source |
| CVE-2026-72304 | redhat_vex | kernel: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put | known affected: 232 known not affected: 42 | 2026-08-18T21:43:22+00:00 | Vulnerability · Source |
| CVE-2026-15792 | redhat_vex | github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request | known affected: 3 | 2026-08-18T21:43:19+00:00 | Vulnerability · Source |
| CVE-2026-17048 | redhat_vex | keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API | fixed: 1 known not affected: 4 | 2026-08-18T21:43:08+00:00 | Vulnerability · Source |
| CVE-2026-14613 | redhat_vex | keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission | fixed: 1 known not affected: 5 | 2026-08-18T21:42:59+00:00 | Vulnerability · Source |
| CVE-2026-9796 | redhat_vex | keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability | fixed: 1 | 2026-08-18T21:42:57+00:00 | Vulnerability · Source |
| CVE-2026-48913 | redhat_vex | httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. | fixed: 32 known affected: 44 known not affected: 38 | 2026-08-18T21:42:46+00:00 | Vulnerability · Source |
| CVE-2025-53020 | redhat_vex | mod_http2: Apache HTTP Server: HTTP/2 DoS by Memory Increase | fixed: 335 known not affected: 79 | 2026-08-18T21:42:39+00:00 | Vulnerability · Source |
| CVE-2026-43951 | redhat_vex | httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime | fixed: 274 known affected: 20 known not affected: 32 | 2026-08-18T21:42:25+00:00 | Vulnerability · Source |
| CVE-2026-32281 | redhat_vex | crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | fixed: 2063 known affected: 184 known not affected: 2076 | 2026-08-18T21:40:50+00:00 | Vulnerability · Source |
| CVE-2026-56819 | redhat_vex | io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak | fixed: 5 known affected: 47 | 2026-08-18T21:38:30+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 7927 known affected: 431 known not affected: 4901 under investigation: 2 | 2026-08-18T21:34:33+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2410 known affected: 45 known not affected: 4360 | 2026-08-18T21:30:27+00:00 | Vulnerability · Source |
| CVE-2025-69223 | redhat_vex | aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | fixed: 220 known affected: 32 known not affected: 6340 | 2026-08-18T21:30:01+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 602 known affected: 321 known not affected: 2189 | 2026-08-18T21:26:22+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 849 known affected: 86 known not affected: 1921 | 2026-08-18T21:24:02+00:00 | Vulnerability · Source |
| CVE-2026-39829 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters | fixed: 1045 known affected: 104 known not affected: 2276 under investigation: 2 | 2026-08-18T21:23:48+00:00 | Vulnerability · Source |
| CVE-2026-33210 | redhat_vex | ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection | fixed: 177 known affected: 1 known not affected: 132 | 2026-08-18T21:23:36+00:00 | Vulnerability · Source |
| CVE-2026-15571 | redhat_vex | keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client | fixed: 1 known not affected: 3 | 2026-08-18T21:23:25+00:00 | Vulnerability · Source |
| CVE-2026-73643 | redhat_vex | js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections | known affected: 69 known not affected: 333 | 2026-08-18T21:22:28+00:00 | Vulnerability · Source |
| CVE-2026-73563 | redhat_vex | @backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass | known affected: 2 | 2026-08-18T21:22:25+00:00 | Vulnerability · Source |