VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
304162 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2419 known affected: 40 known not affected: 4478 | 2026-10-02T04:18:41+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3866 known affected: 68 known not affected: 13220 | 2026-10-02T04:18:14+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2839 known affected: 57 known not affected: 6263 under investigation: 1 | 2026-10-02T04:17:57+00:00 | Vulnerability · Source |
| CVE-2025-22868 | redhat_vex | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | fixed: 2199 known affected: 93 known not affected: 8426 | 2026-10-02T04:17:41+00:00 | Vulnerability · Source |
| CVE-2024-52011 | redhat_vex | launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization | fixed: 8 known not affected: 145 | 2026-10-02T04:17:36+00:00 | Vulnerability · Source |
| CVE-2026-44740 | redhat_vex | github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation | fixed: 525 known affected: 100 known not affected: 2311 | 2026-10-02T04:16:50+00:00 | Vulnerability · Source |
| CVE-2026-27145 | redhat_vex | crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | fixed: 1083 known affected: 74 known not affected: 5346 | 2026-10-02T04:16:30+00:00 | Vulnerability · Source |
| CVE-2023-39325 | redhat_vex | golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) | fixed: 6046 known affected: 223 known not affected: 30360 | 2026-10-02T04:09:01+00:00 | Vulnerability · Source |
| CVE-2026-40895 | redhat_vex | follow-redirects: follow-redirects: Information disclosure via cross-domain redirects | fixed: 218 known affected: 39 known not affected: 6475 | 2026-10-02T04:06:49+00:00 | Vulnerability · Source |
| CVE-2026-39831 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check | fixed: 402 known affected: 136 known not affected: 5964 | 2026-10-02T04:06:38+00:00 | Vulnerability · Source |
| CVE-2026-33896 | redhat_vex | node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance | fixed: 8 known affected: 19 known not affected: 344 | 2026-10-02T04:05:43+00:00 | Vulnerability · Source |
| CVE-2026-33895 | redhat_vex | node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures | fixed: 8 known affected: 13 known not affected: 350 | 2026-10-02T04:05:38+00:00 | Vulnerability · Source |
| CVE-2026-33894 | redhat_vex | node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification | fixed: 33 known affected: 16 known not affected: 496 | 2026-10-02T04:05:31+00:00 | Vulnerability · Source |
| CVE-2026-33891 | redhat_vex | node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() | fixed: 10 known affected: 14 known not affected: 595 | 2026-10-02T04:05:09+00:00 | Vulnerability · Source |
| CVE-2026-33811 | redhat_vex | net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | fixed: 1835 known affected: 138 known not affected: 8314 | 2026-10-02T04:04:28+00:00 | Vulnerability · Source |
| CVE-2026-33228 | redhat_vex | flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON. | fixed: 14 known affected: 11 known not affected: 181 | 2026-10-02T04:04:07+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 3352 known affected: 364 known not affected: 39263 | 2026-10-02T04:03:11+00:00 | Vulnerability · Source |
| CVE-2026-6322 | redhat_vex | fast-uri: fast-uri: URI authority bypass due to improper delimiter handling | fixed: 628 known affected: 29 known not affected: 6954 | 2026-10-02T04:03:01+00:00 | Vulnerability · Source |
| CVE-2026-4800 | redhat_vex | lodash: lodash: Arbitrary code execution via untrusted input in template imports | fixed: 1010 known affected: 113 known not affected: 10848 | 2026-10-02T04:02:47+00:00 | Vulnerability · Source |
| CVE-2026-55677 | redhat_vex | github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy | fixed: 234 known affected: 1 known not affected: 721 | 2026-10-02T04:02:33+00:00 | Vulnerability · Source |
| CVE-2026-27137 | redhat_vex | crypto/x509: Incorrect enforcement of email constraints in crypto/x509 | fixed: 540 known affected: 170 known not affected: 1317 | 2026-10-02T03:59:50+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 950 known affected: 89 known not affected: 5148 | 2026-10-02T03:58:09+00:00 | Vulnerability · Source |
| CVE-2026-48779 | redhat_vex | ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments | fixed: 613 known affected: 39 known not affected: 1178 | 2026-10-02T03:57:28+00:00 | Vulnerability · Source |
| CVE-2026-12151 | redhat_vex | undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames | fixed: 660 known affected: 13 known not affected: 2342 | 2026-10-02T03:56:19+00:00 | Vulnerability · Source |
| CVE-2026-9697 | redhat_vex | undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy | fixed: 437 known affected: 13 known not affected: 2327 | 2026-10-02T03:55:39+00:00 | Vulnerability · Source |
| CVE-2026-6734 | redhat_vex | undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing | fixed: 429 known affected: 12 known not affected: 1027 | 2026-10-02T03:55:06+00:00 | Vulnerability · Source |
| CVE-2026-46595 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation | fixed: 307 known affected: 58 known not affected: 2269 | 2026-10-02T03:54:12+00:00 | Vulnerability · Source |
| CVE-2026-42508 | redhat_vex | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey | fixed: 1077 known affected: 50 known not affected: 2434 | 2026-10-02T03:53:48+00:00 | Vulnerability · Source |
| CVE-2026-39832 | redhat_vex | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions | fixed: 1022 known affected: 65 known not affected: 2524 | 2026-10-02T03:53:10+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 1133 known affected: 107 known not affected: 5498 | 2026-10-02T03:52:02+00:00 | Vulnerability · Source |
| CVE-2026-35469 | redhat_vex | Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code | fixed: 588 known affected: 53 known not affected: 24282 | 2026-10-02T03:50:50+00:00 | Vulnerability · Source |
| CVE-2026-25679 | redhat_vex | net/url: Incorrect parsing of IPv6 host literals in net/url | fixed: 10125 known affected: 143 known not affected: 5770 under investigation: 1 | 2026-10-02T03:48:29+00:00 | Vulnerability · Source |
| CVE-2026-6321 | redhat_vex | fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies | fixed: 672 known affected: 11 known not affected: 1216 | 2026-10-02T03:38:14+00:00 | Vulnerability · Source |
| CVE-2026-9277 | redhat_vex | shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators | fixed: 167 known affected: 19 known not affected: 7976 | 2026-10-02T03:26:51+00:00 | Vulnerability · Source |
| CVE-2026-73643 | redhat_vex | js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections | fixed: 58 known affected: 39 known not affected: 1796 | 2026-10-02T03:26:51+00:00 | Vulnerability · Source |
| CVE-2023-41900 | redhat_vex | jetty: OpenId Revoked authentication allows one request | fixed: 1 known affected: 37 known not affected: 8 | 2026-10-02T03:02:15+00:00 | Vulnerability · Source |
| CVE-2023-42794 | redhat_vex | tomcat: FileUpload: DoS due to accumulation of temporary files on Windows | fixed: 20 known affected: 10 known not affected: 25 | 2026-10-02T03:02:15+00:00 | Vulnerability · Source |
| CVE-2023-46604 | redhat_vex | activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack | fixed: 6 known affected: 1 | 2026-10-02T03:02:15+00:00 | Vulnerability · Source |
| CVE-2024-21733 | redhat_vex | tomcat: Leaking of unrelated request bodies in default error page | fixed: 2 known not affected: 66 | 2026-10-02T03:00:57+00:00 | Vulnerability · Source |
| CVE-2023-34055 | redhat_vex | spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service | fixed: 1 known affected: 10 known not affected: 17 | 2026-10-02T03:00:56+00:00 | Vulnerability · Source |
| CVE-2024-22257 | redhat_vex | spring-security: Broken Access Control With Direct Use of AuthenticatedVoter | fixed: 3 known affected: 9 known not affected: 7 | 2026-10-02T03:00:56+00:00 | Vulnerability · Source |
| CVE-2023-5072 | redhat_vex | JSON-java: parser confusion leads to OOM | fixed: 8 known affected: 7 known not affected: 9 | 2026-10-02T03:00:54+00:00 | Vulnerability · Source |
| CVE-2023-6481 | redhat_vex | logback: A serialization vulnerability in logback receiver | fixed: 122 known affected: 14 known not affected: 10 | 2026-10-02T03:00:54+00:00 | Vulnerability · Source |
| CVE-2023-39410 | redhat_vex | apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK | fixed: 96 known affected: 10 known not affected: 3486 | 2026-10-02T03:00:53+00:00 | Vulnerability · Source |
| CVE-2023-6378 | redhat_vex | logback: serialization vulnerability in logback receiver | fixed: 6 known affected: 16 known not affected: 43 | 2026-10-02T03:00:53+00:00 | Vulnerability · Source |
| CVE-2023-40167 | redhat_vex | jetty: Improper validation of HTTP/1 content-length | fixed: 16 known affected: 48 known not affected: 1950 | 2026-10-02T03:00:52+00:00 | Vulnerability · Source |
| CVE-2023-50290 | redhat_vex | Solr: Host environment variables are published via the Metrics API | fixed: 1 known not affected: 6 | 2026-10-02T03:00:51+00:00 | Vulnerability · Source |
| CVE-2022-41678 | redhat_vex | ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE | fixed: 11 known affected: 4 known not affected: 12 | 2026-10-02T03:00:50+00:00 | Vulnerability · Source |
| CVE-2024-22243 | redhat_vex | springframework: URL Parsing with Host Validation | fixed: 1 known affected: 2 known not affected: 2 | 2026-10-02T03:00:49+00:00 | Vulnerability · Source |
| CVE-2023-46749 | redhat_vex | shiro: path traversal attack may lead to authentication bypass | fixed: 1 known affected: 1 known not affected: 6 | 2026-10-02T03:00:48+00:00 | Vulnerability · Source |