VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
304160 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-32280 | redhat_vex | crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | fixed: 4575 known affected: 133 known not affected: 7225 | 2026-10-02T04:26:35+00:00 | Vulnerability · Source |
| CVE-2026-42504 | redhat_vex | mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header | fixed: 4730 known affected: 106 known not affected: 6283 | 2026-10-02T04:26:10+00:00 | Vulnerability · Source |
| CVE-2026-41178 | redhat_vex | github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers | fixed: 1083 known affected: 213 known not affected: 6482 | 2026-10-02T04:24:55+00:00 | Vulnerability · Source |
| CVE-2026-32141 | redhat_vex | flatted: flatted: Unbounded recursion DoS in parse() revive phase | fixed: 31 known affected: 21 known not affected: 283 | 2026-10-02T04:22:02+00:00 | Vulnerability · Source |
| CVE-2026-29063 | redhat_vex | immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution | fixed: 498 known affected: 34 known not affected: 12737 | 2026-10-02T04:21:47+00:00 | Vulnerability · Source |
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 1332 known affected: 240 known not affected: 8613 | 2026-10-02T04:21:25+00:00 | Vulnerability · Source |
| CVE-2026-13676 | redhat_vex | fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization | fixed: 386 known affected: 38 known not affected: 5293 | 2026-10-02T04:21:03+00:00 | Vulnerability · Source |
| CVE-2026-12143 | redhat_vex | form-data: form-data: Form field override via CRLF injection | fixed: 495 known affected: 39 known not affected: 8567 | 2026-10-02T04:20:58+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 329 known affected: 42 known not affected: 1297 | 2026-10-02T04:20:35+00:00 | Vulnerability · Source |
| CVE-2025-66471 | redhat_vex | urllib3: urllib3 Streaming API improperly handles highly compressed data | fixed: 1965 known affected: 126 known not affected: 3875 | 2026-10-02T04:20:20+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1992 known affected: 379 known not affected: 2959 | 2026-10-02T04:20:13+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 115 known not affected: 1099 | 2026-10-02T04:19:58+00:00 | Vulnerability · Source |
| CVE-2025-62718 | redhat_vex | axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization | fixed: 162 known affected: 62 known not affected: 1807 | 2026-10-02T04:19:52+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 8116 known affected: 434 known not affected: 5144 | 2026-10-02T04:19:28+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 11000 known affected: 445 known not affected: 17461 | 2026-10-02T04:19:23+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2419 known affected: 40 known not affected: 4478 | 2026-10-02T04:18:41+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3866 known affected: 68 known not affected: 13220 | 2026-10-02T04:18:14+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2839 known affected: 57 known not affected: 6263 under investigation: 1 | 2026-10-02T04:17:57+00:00 | Vulnerability · Source |
| CVE-2025-22868 | redhat_vex | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | fixed: 2199 known affected: 93 known not affected: 8426 | 2026-10-02T04:17:41+00:00 | Vulnerability · Source |
| CVE-2024-52011 | redhat_vex | launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization | fixed: 8 known not affected: 145 | 2026-10-02T04:17:36+00:00 | Vulnerability · Source |
| CVE-2026-56853 | redhat_vex | net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service | fixed: 2408 known affected: 258 known not affected: 2081 | 2026-10-02T04:17:15+00:00 | Vulnerability · Source |
| CVE-2026-56852 | redhat_vex | golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input | fixed: 766 known affected: 97 known not affected: 8659 under investigation: 237 | 2026-10-02T04:16:53+00:00 | Vulnerability · Source |
| CVE-2026-44740 | redhat_vex | github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation | fixed: 525 known affected: 100 known not affected: 2311 | 2026-10-02T04:16:50+00:00 | Vulnerability · Source |
| CVE-2026-27145 | redhat_vex | crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | fixed: 1083 known affected: 74 known not affected: 5346 | 2026-10-02T04:16:30+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 1345 known affected: 178 known not affected: 13996 | 2026-10-02T04:13:09+00:00 | Vulnerability · Source |
| CVE-2023-39325 | redhat_vex | golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) | fixed: 6046 known affected: 223 known not affected: 30360 | 2026-10-02T04:09:01+00:00 | Vulnerability · Source |
| CVE-2026-40895 | redhat_vex | follow-redirects: follow-redirects: Information disclosure via cross-domain redirects | fixed: 218 known affected: 39 known not affected: 6475 | 2026-10-02T04:06:49+00:00 | Vulnerability · Source |
| CVE-2026-39831 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check | fixed: 402 known affected: 136 known not affected: 5964 | 2026-10-02T04:06:38+00:00 | Vulnerability · Source |
| CVE-2026-33896 | redhat_vex | node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance | fixed: 8 known affected: 19 known not affected: 344 | 2026-10-02T04:05:43+00:00 | Vulnerability · Source |
| CVE-2026-33895 | redhat_vex | node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures | fixed: 8 known affected: 13 known not affected: 350 | 2026-10-02T04:05:38+00:00 | Vulnerability · Source |
| CVE-2026-33894 | redhat_vex | node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification | fixed: 33 known affected: 16 known not affected: 496 | 2026-10-02T04:05:31+00:00 | Vulnerability · Source |
| CVE-2026-33891 | redhat_vex | node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() | fixed: 10 known affected: 14 known not affected: 595 | 2026-10-02T04:05:09+00:00 | Vulnerability · Source |
| CVE-2026-33811 | redhat_vex | net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | fixed: 1835 known affected: 138 known not affected: 8314 | 2026-10-02T04:04:28+00:00 | Vulnerability · Source |
| CVE-2026-33228 | redhat_vex | flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON. | fixed: 14 known affected: 11 known not affected: 181 | 2026-10-02T04:04:07+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3352 known affected: 364 known not affected: 39263 | 2026-10-02T04:03:11+00:00 | Vulnerability · Source |
| CVE-2026-6322 | redhat_vex | fast-uri: fast-uri: URI authority bypass due to improper delimiter handling | fixed: 628 known affected: 29 known not affected: 6954 | 2026-10-02T04:03:01+00:00 | Vulnerability · Source |
| CVE-2026-4800 | redhat_vex | lodash: lodash: Arbitrary code execution via untrusted input in template imports | fixed: 1010 known affected: 113 known not affected: 10848 | 2026-10-02T04:02:47+00:00 | Vulnerability · Source |
| CVE-2026-55677 | redhat_vex | github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy | fixed: 234 known affected: 1 known not affected: 721 | 2026-10-02T04:02:33+00:00 | Vulnerability · Source |
| CVE-2026-27137 | redhat_vex | crypto/x509: Incorrect enforcement of email constraints in crypto/x509 | fixed: 540 known affected: 170 known not affected: 1317 | 2026-10-02T03:59:50+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 950 known affected: 89 known not affected: 5148 | 2026-10-02T03:58:09+00:00 | Vulnerability · Source |
| CVE-2026-48779 | redhat_vex | ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments | fixed: 613 known affected: 39 known not affected: 1178 | 2026-10-02T03:57:28+00:00 | Vulnerability · Source |
| CVE-2026-12151 | redhat_vex | undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames | fixed: 660 known affected: 13 known not affected: 2342 | 2026-10-02T03:56:19+00:00 | Vulnerability · Source |
| CVE-2026-9697 | redhat_vex | undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy | fixed: 437 known affected: 13 known not affected: 2327 | 2026-10-02T03:55:39+00:00 | Vulnerability · Source |
| CVE-2026-6734 | redhat_vex | undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing | fixed: 429 known affected: 12 known not affected: 1027 | 2026-10-02T03:55:06+00:00 | Vulnerability · Source |
| CVE-2026-46595 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation | fixed: 307 known affected: 58 known not affected: 2269 | 2026-10-02T03:54:12+00:00 | Vulnerability · Source |
| CVE-2026-42508 | redhat_vex | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey | fixed: 1077 known affected: 50 known not affected: 2434 | 2026-10-02T03:53:48+00:00 | Vulnerability · Source |
| CVE-2026-39832 | redhat_vex | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions | fixed: 1022 known affected: 65 known not affected: 2524 | 2026-10-02T03:53:10+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 1133 known affected: 107 known not affected: 5498 | 2026-10-02T03:52:02+00:00 | Vulnerability · Source |
| CVE-2026-35469 | redhat_vex | Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code | fixed: 588 known affected: 53 known not affected: 24282 | 2026-10-02T03:50:50+00:00 | Vulnerability · Source |
| CVE-2026-25679 | redhat_vex | net/url: Incorrect parsing of IPv6 host literals in net/url | fixed: 10125 known affected: 143 known not affected: 5770 under investigation: 1 | 2026-10-02T03:48:29+00:00 | Vulnerability · Source |