VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
305236 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-69896 | microsoft_vex | Windows Error Reporting Elevation of Privilege Vulnerability | fixed: 8 known affected: 8 | 2026-10-13T07:00:00+00:00 | Vulnerability · Source |
| CVE-2024-31463 | redhat_vex | ironic-image: Unauthenticated local access to Ironic API | fixed: 8 known affected: 1 known not affected: 2300 | 2026-10-07T12:41:25+00:00 | Vulnerability · Source |
| CVE-2026-107159 | redhat_vex | miniupnpd: miniupnpd: Denial of Service via crafted SSDP search request | known not affected: 1 | 2026-10-07T12:36:30+00:00 | Vulnerability · Source |
| CVE-2026-106462 | redhat_vex | backstage: Backstage: Privilege escalation via improper credential boundary enforcement | known affected: 4 | 2026-10-07T12:36:21+00:00 | Vulnerability · Source |
| CVE-2026-106457 | redhat_vex | plugin-auth-backend-module-cloudflare-access-provider: Backstage: Unauthorized access via missing token audience validation | known affected: 2 | 2026-10-07T12:36:11+00:00 | Vulnerability · Source |
| CVE-2026-106455 | redhat_vex | @backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node: Information disclosure via improper MkDocs configuration validation | known affected: 3 | 2026-10-07T12:36:06+00:00 | Vulnerability · Source |
| CVE-2026-69097 | redhat_vex | gitpython: GitPython: Remote Code Execution via Config Injection in Submodule Names | known affected: 38 known not affected: 40 | 2026-10-07T12:36:05+00:00 | Vulnerability · Source |
| CVE-2026-106486 | redhat_vex | plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions | known affected: 1 | 2026-10-07T12:35:55+00:00 | Vulnerability · Source |
| CVE-2026-104848 | redhat_vex | tinypool: tinypool: arbitrary code execution via prototype pollution in worker options | known affected: 9 known not affected: 6 | 2026-10-07T12:35:50+00:00 | Vulnerability · Source |
| CVE-2026-94637 | redhat_vex | github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of compressed data | known affected: 69 known not affected: 11 | 2026-10-07T12:35:41+00:00 | Vulnerability · Source |
| CVE-2026-83663 | redhat_vex | github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports | known affected: 69 known not affected: 11 | 2026-10-07T12:35:37+00:00 | Vulnerability · Source |
| CVE-2026-78847 | redhat_vex | gray-matter: gray-matter: arbitrary code execution via eval in front matter parsing | known affected: 3 | 2026-10-07T12:35:33+00:00 | Vulnerability · Source |
| CVE-2026-66046 | redhat_vex | expat: Expat: Denial of Service via quadratic complexity in attribute processing | fixed: 84 known affected: 35 | 2026-10-07T12:35:23+00:00 | Vulnerability · Source |
| CVE-2026-56862 | redhat_vex | crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | fixed: 7358 known affected: 266 known not affected: 3525 | 2026-10-07T12:35:21+00:00 | Vulnerability · Source |
| CVE-2026-56860 | redhat_vex | net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | fixed: 7416 known affected: 273 known not affected: 3668 | 2026-10-07T12:35:06+00:00 | Vulnerability · Source |
| CVE-2026-56859 | redhat_vex | encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | fixed: 6914 known affected: 245 known not affected: 3526 | 2026-10-07T12:34:59+00:00 | Vulnerability · Source |
| CVE-2026-56858 | redhat_vex | html/template: golang: Go html/template: Cross-Site Scripting via pathological input | fixed: 6854 known affected: 213 known not affected: 3347 | 2026-10-07T12:34:50+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 950 known affected: 88 known not affected: 5149 | 2026-10-07T12:34:42+00:00 | Vulnerability · Source |
| CVE-2026-33818 | redhat_vex | encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | fixed: 7345 known affected: 197 known not affected: 3117 | 2026-10-07T12:34:41+00:00 | Vulnerability · Source |
| CVE-2026-33814 | redhat_vex | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | fixed: 2465 known affected: 363 known not affected: 30161 under investigation: 496 | 2026-10-07T12:34:36+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2419 known affected: 40 known not affected: 4478 | 2026-10-07T12:34:31+00:00 | Vulnerability · Source |
| CVE-2024-4438 | redhat_vex | etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform | fixed: 18 known affected: 1 | 2026-10-07T12:34:28+00:00 | Vulnerability · Source |
| CVE-2024-4437 | redhat_vex | etcd: Incomplete fix for CVE-2021-44716 in OpenStack Platform | fixed: 14 known affected: 1 known not affected: 2 | 2026-10-07T12:34:26+00:00 | Vulnerability · Source |
| CVE-2023-1633 | redhat_vex | openstack-barbican: Insecure Barbican configuration file leaking credential | fixed: 2 known affected: 28 known not affected: 5 | 2026-10-07T12:34:26+00:00 | Vulnerability · Source |
| CVE-2024-4436 | redhat_vex | etcd: Incomplete fix for CVE-2022-41723 in OpenStack Platform | fixed: 14 known affected: 1 known not affected: 2 | 2026-10-07T12:34:26+00:00 | Vulnerability · Source |
| CVE-2026-73073 | redhat_vex | vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion | fixed: 32 known affected: 14 known not affected: 188 | 2026-10-07T12:19:46+00:00 | Vulnerability · Source |
| CVE-2026-106493 | redhat_vex | backstage: Backstage: Information disclosure via improper object path validation in cloud storage catalog providers | known affected: 5 | 2026-10-07T12:10:22+00:00 | Vulnerability · Source |
| CVE-2026-64115 | redhat_vex | kernel: vsock/vmci: fix UAF when peer resets connection during handshake | fixed: 30 known affected: 245 known not affected: 14 | 2026-10-07T12:10:18+00:00 | Vulnerability · Source |
| CVE-2026-89530 | redhat_vex | kernel: svcrdma: Reject inline replies that overflow the pull-up buffer | fixed: 30 known affected: 247 under investigation: 14 | 2026-10-07T12:09:47+00:00 | Vulnerability · Source |
| CVE-2026-74582 | redhat_vex | kernel: packet: use consistent hard_header_len in non-ring send paths | fixed: 1248 known affected: 217 known not affected: 43 | 2026-10-07T12:09:45+00:00 | Vulnerability · Source |
| CVE-2026-34356 | redhat_vex | httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers | fixed: 441 known not affected: 165 | 2026-10-07T12:03:16+00:00 | Vulnerability · Source |
| CVE-2026-106494 | redhat_vex | @backstage/backend-defaults: @backstage/backend-defaults: Content injection via crafted cloud storage object names | known affected: 5 | 2026-10-07T12:02:29+00:00 | Vulnerability · Source |
| CVE-2026-106489 | redhat_vex | @backstage/plugin-techdocs-backend: Backstage: Information disclosure via improper authorization in TechDocs backend | known affected: 3 | 2026-10-07T12:02:23+00:00 | Vulnerability · Source |
| CVE-2026-106463 | redhat_vex | @backstage/plugin-catalog-backend-module-gitlab: Backstage plugin-catalog-backend-module-gitlab: Unauthorized access via improper GitLab user ingestion | known affected: 2 | 2026-10-07T12:02:14+00:00 | Vulnerability · Source |
| CVE-2026-106460 | redhat_vex | @backstage/plugin-auth-node: @backstage/plugin-auth-node: Privilege escalation via improper email verification | known affected: 7 | 2026-10-07T12:02:08+00:00 | Vulnerability · Source |
| CVE-2026-106492 | redhat_vex | @backstage/backend-defaults: @backstage/backend-defaults: Access control bypass via improper service credential delegation | known affected: 5 | 2026-10-07T12:01:54+00:00 | Vulnerability · Source |
| CVE-2026-103262 | redhat_vex | tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient | known affected: 66 known not affected: 5 | 2026-10-07T12:01:43+00:00 | Vulnerability · Source |
| CVE-2026-73501 | redhat_vex | github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default | fixed: 12 known affected: 88 known not affected: 39 | 2026-10-07T12:01:34+00:00 | Vulnerability · Source |
| CVE-2026-64564 | redhat_vex | kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing | fixed: 2227 known affected: 24 known not affected: 14 | 2026-10-07T12:01:26+00:00 | Vulnerability · Source |
| CVE-2026-54876 | redhat_vex | openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking | fixed: 68 known affected: 48 known not affected: 252 under investigation: 12 | 2026-10-07T12:00:23+00:00 | Vulnerability · Source |
| CVE-2026-45186 | redhat_vex | libexpat: denial of service via crafted XML input | fixed: 88 known affected: 26 known not affected: 2 under investigation: 10 | 2026-10-07T12:00:15+00:00 | Vulnerability · Source |
| CVE-2026-41178 | redhat_vex | github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers | fixed: 1087 known affected: 211 known not affected: 6521 | 2026-10-07T12:00:06+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2999 known affected: 144 known not affected: 16904 | 2026-10-07T11:59:57+00:00 | Vulnerability · Source |
| CVE-2026-34355 | redhat_vex | httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass | fixed: 441 known affected: 15 known not affected: 150 | 2026-10-07T11:59:51+00:00 | Vulnerability · Source |
| CVE-2025-5889 | redhat_vex | brace-expansion: juliangruber brace-expansion index.js expand redos | fixed: 497 known affected: 143 known not affected: 94 under investigation: 1 | 2026-10-07T11:59:33+00:00 | Vulnerability · Source |
| CVE-2026-11979 | redhat_vex | libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow | fixed: 193 known affected: 20 known not affected: 6 under investigation: 1 | 2026-10-07T11:59:33+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3352 known affected: 362 known not affected: 39265 | 2026-10-07T11:59:33+00:00 | Vulnerability · Source |
| CVE-2026-29181 | redhat_vex | github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers | fixed: 36 known affected: 11 known not affected: 414 under investigation: 1 | 2026-10-07T11:59:33+00:00 | Vulnerability · Source |
| CVE-2026-81725 | redhat_vex | nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks | known affected: 14 known not affected: 1 | 2026-10-07T11:47:23+00:00 | Vulnerability · Source |
| CVE-2026-48005 | redhat_vex | httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest | fixed: 23 known affected: 61 known not affected: 6 | 2026-10-07T11:18:34+00:00 | Vulnerability · Source |