VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
291904 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2014-8153 | redhat_vex | openstack-neutron: L3 agent denial of service with radvd 2.0+ (OSSA 2015-001) | known not affected: 3 | 2026-08-09T19:06:20+00:00 | Vulnerability · Source |
| CVE-2013-2013 | redhat_vex | keystone: password disclosure on command line | known not affected: 1 | 2026-08-09T19:06:20+00:00 | Vulnerability · Source |
| CVE-2026-31461 | redhat_vex | kernel: drm/amd/display: Fix drm_edid leak in amdgpu_dm | known affected: 274 | 2026-08-09T19:06:20+00:00 | Vulnerability · Source |
| CVE-2011-4076 | redhat_vex | openstack-nova: EC2 API password leak | known not affected: 1 | 2026-08-09T19:06:20+00:00 | Vulnerability · Source |
| CVE-2026-64335 | redhat_vex | kernel: USB: serial: digi_acceleport: fix broken rx after throttle | known affected: 274 | 2026-08-09T19:06:16+00:00 | Vulnerability · Source |
| CVE-2012-4573 | redhat_vex | OpenStack: Glance Authentication bypass for image deletion | fixed: 4 | 2026-08-09T19:06:12+00:00 | Vulnerability · Source |
| CVE-2012-5483 | redhat_vex | OpenStack: Keystone /etc/keystone/ec2rc secret key exposure | fixed: 5 | 2026-08-09T19:06:12+00:00 | Vulnerability · Source |
| CVE-2013-6406 | redhat_vex | Horizon: Nova strings persistent XSS | known not affected: 2 | 2026-08-09T19:06:11+00:00 | Vulnerability · Source |
| CVE-2021-3724 | redhat_vex | serverless: incomplete fix of CVE-2021-27918 | known affected: 1 | 2026-08-09T19:06:09+00:00 | Vulnerability · Source |
| CVE-2026-64457 | redhat_vex | kernel: virtio_pci: fix vq info pointer lookup via wrong index | known affected: 76 known not affected: 198 | 2026-08-09T19:06:07+00:00 | Vulnerability · Source |
| CVE-2024-7318 | redhat_vex | keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity | fixed: 8 | 2026-08-09T19:06:06+00:00 | Vulnerability · Source |
| CVE-2024-5967 | redhat_vex | keycloak: Leak of configured LDAP bind credentials through the Keycloak admin console | fixed: 21 | 2026-08-09T19:06:06+00:00 | Vulnerability · Source |
| CVE-2024-4603 | redhat_vex | openssl: Excessive time spent checking DSA keys and parameters | fixed: 49 known affected: 12 known not affected: 71 | 2026-08-09T19:06:06+00:00 | Vulnerability · Source |
| CVE-2024-4540 | redhat_vex | keycloak: exposure of sensitive information in Pushed Authorization Requests (PAR) KC_RESTART cookie | fixed: 28 | 2026-08-09T19:06:05+00:00 | Vulnerability · Source |
| CVE-2024-4028 | redhat_vex | keycloak-core: Stored XSS in Keycloak when creating a items in Admin Console | known affected: 1 known not affected: 1 | 2026-08-09T19:06:04+00:00 | Vulnerability · Source |
| CVE-2024-1722 | redhat_vex | keycloak-core: DoS via account lockout | known affected: 2 | 2026-08-09T19:06:04+00:00 | Vulnerability · Source |
| CVE-2019-15601 | redhat_vex | curl: improper input validation allows users to create a 'FILE:' URL that can make the client access a remote file using SMB | known not affected: 27 | 2026-08-09T19:06:01+00:00 | Vulnerability · Source |
| CVE-2022-45143 | redhat_vex | tomcat: JsonErrorReportValve injection | fixed: 38 known affected: 48 known not affected: 9 | 2026-08-09T19:06:01+00:00 | Vulnerability · Source |
| CVE-2019-1549 | redhat_vex | openssl: information disclosure in fork() | fixed: 124 known affected: 4 known not affected: 15 | 2026-08-09T19:06:00+00:00 | Vulnerability · Source |
| CVE-2018-5730 | redhat_vex | krb5: DN container check bypass by supplying special crafted data | fixed: 117 known affected: 11 known not affected: 9 | 2026-08-09T19:05:57+00:00 | Vulnerability · Source |
| CVE-2026-15920 | redhat_vex | django: Django: Cross-site scripting via unvalidated URLField values in the admin | known affected: 47 | 2026-08-09T18:19:17+00:00 | Vulnerability · Source |
| CVE-2026-15830 | redhat_vex | django: Django: Denial of Service via parsing deeply nested geometry collections | known affected: 47 | 2026-08-09T18:07:55+00:00 | Vulnerability · Source |
| CVE-2026-15337 | redhat_vex | django: Django: Denial-of-service vulnerability due to excessive memory consumption | known affected: 47 | 2026-08-09T18:07:11+00:00 | Vulnerability · Source |
| CVE-2026-16089 | redhat_vex | keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session | known affected: 3 known not affected: 3 | 2026-08-09T16:33:04+00:00 | Vulnerability · Source |
| CVE-2026-15945 | redhat_vex | keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 | known affected: 6 | 2026-08-09T16:28:21+00:00 | Vulnerability · Source |
| CVE-2026-71437 | suse_vex | SUSE CVE CVE-2026-71437 | No product status | 2026-08-09T16:16:59+00:00 | Vulnerability · Source |
| CVE-2026-1609 | redhat_vex | org.keycloak/keycloak-quarkus-server: Keycloak: Unauthorized Access via JWT authorization grant with disabled users | known not affected: 6 | 2026-08-09T15:34:27+00:00 | Vulnerability · Source |
| CVE-2026-4948 | microsoft_vex | Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization | fixed: 2 known affected: 5 | 2026-08-09T14:49:49+00:00 | Vulnerability · Source |
| CVE-2026-41602 | microsoft_vex | Apache Thrift: Go TFramedTransport uint32 overflow | fixed: 5 known affected: 15 | 2026-08-09T14:49:43+00:00 | Vulnerability · Source |
| CVE-2026-6238 | microsoft_vex | Buffer overread in ns_printrrf with corrupted RDATA field | known affected: 5 | 2026-08-09T14:49:24+00:00 | Vulnerability · Source |
| CVE-2026-34003 | microsoft_vex | Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access | fixed: 2 known affected: 5 | 2026-08-09T14:49:16+00:00 | Vulnerability · Source |
| CVE-2026-34001 | microsoft_vex | Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption | fixed: 2 known affected: 5 | 2026-08-09T14:49:11+00:00 | Vulnerability · Source |
| CVE-2026-33999 | microsoft_vex | Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling | fixed: 2 known affected: 4 | 2026-08-09T14:49:05+00:00 | Vulnerability · Source |
| CVE-2026-5435 | microsoft_vex | Potential buffer overflow in ns_sprintrrf TSIG handling path | known affected: 5 | 2026-08-09T14:48:59+00:00 | Vulnerability · Source |
| CVE-2026-31663 | microsoft_vex | xfrm: hold dev ref until after transport_finish NF_HOOK | known affected: 11 | 2026-08-09T14:48:52+00:00 | Vulnerability · Source |
| CVE-2026-3219 | microsoft_vex | pip doesn't reject concatenated ZIP and tar archives | fixed: 4 known affected: 8 known not affected: 2 | 2026-08-09T14:48:44+00:00 | Vulnerability · Source |
| CVE-2026-5958 | microsoft_vex | Race Condition in GNU Sed | fixed: 2 known affected: 5 | 2026-08-09T14:48:38+00:00 | Vulnerability · Source |
| CVE-2026-5450 | microsoft_vex | scanf %mc off-by-one heap buffer overflow | known affected: 5 | 2026-08-09T14:48:33+00:00 | Vulnerability · Source |
| CVE-2026-5928 | microsoft_vex | Static buffer overflow in deprecated nis_local_principal | known affected: 5 | 2026-08-09T14:48:25+00:00 | Vulnerability · Source |
| CVE-2026-4786 | microsoft_vex | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | fixed: 1 known affected: 3 known not affected: 1 | 2026-08-09T14:48:18+00:00 | Vulnerability · Source |
| CVE-2026-6100 | microsoft_vex | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | fixed: 1 known affected: 3 | 2026-08-09T14:48:10+00:00 | Vulnerability · Source |
| CVE-2026-34446 | microsoft_vex | ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load | fixed: 1 known affected: 4 | 2026-08-09T14:48:03+00:00 | Vulnerability · Source |
| CVE-2026-35388 | microsoft_vex | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. | fixed: 1 known affected: 4 | 2026-08-09T14:47:52+00:00 | Vulnerability · Source |
| CVE-2026-35414 | microsoft_vex | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. | fixed: 1 known affected: 5 | 2026-08-09T14:47:46+00:00 | Vulnerability · Source |
| CVE-2026-5119 | microsoft_vex | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment | known affected: 5 | 2026-08-09T14:47:40+00:00 | Vulnerability · Source |
| CVE-2026-5201 | microsoft_vex | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image | fixed: 1 known affected: 3 | 2026-08-09T14:47:33+00:00 | Vulnerability · Source |
| CVE-2026-4046 | microsoft_vex | iconv crash due to assertion failure with untrusted input | fixed: 1 known affected: 4 | 2026-08-09T14:47:27+00:00 | Vulnerability · Source |
| CVE-2026-21710 | microsoft_vex | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | fixed: 2 known affected: 5 | 2026-08-09T14:47:22+00:00 | Vulnerability · Source |
| CVE-2026-21717 | microsoft_vex | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | fixed: 1 known affected: 5 known not affected: 1 | 2026-08-09T14:47:16+00:00 | Vulnerability · Source |
| CVE-2026-4833 | microsoft_vex | Orc discount Markdown markdown.c compile recursion | known affected: 5 | 2026-08-09T14:47:10+00:00 | Vulnerability · Source |