VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
226012 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1941 known affected: 413 known not affected: 2590 under investigation: 1 | 2026-08-15T15:05:43+00:00 | Vulnerability · Source |
| CVE-2025-66471 | redhat_vex | urllib3: urllib3 Streaming API improperly handles highly compressed data | fixed: 1957 known affected: 347 known not affected: 3325 under investigation: 1 | 2026-08-15T15:05:03+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 7927 known affected: 432 known not affected: 4900 under investigation: 2 | 2026-08-15T15:02:58+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2410 known affected: 45 known not affected: 4360 | 2026-08-15T14:52:49+00:00 | Vulnerability · Source |
| CVE-2025-69223 | redhat_vex | aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | fixed: 220 known affected: 32 known not affected: 6340 | 2026-08-15T14:38:13+00:00 | Vulnerability · Source |
| CVE-2026-33186 | redhat_vex | google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation | fixed: 2993 known affected: 383 known not affected: 35942 | 2026-08-15T14:37:44+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 569 known affected: 262 known not affected: 3418 | 2026-08-15T14:37:26+00:00 | Vulnerability · Source |
| CVE-2026-21441 | redhat_vex | urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) | fixed: 1947 known affected: 385 known not affected: 2923 under investigation: 1 | 2026-08-15T14:37:22+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 329 known affected: 63 known not affected: 1294 | 2026-08-15T14:37:04+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 115 known not affected: 1097 | 2026-08-15T14:36:06+00:00 | Vulnerability · Source |
| CVE-2025-61726 | redhat_vex | golang: net/url: Memory exhaustion in query parameter parsing in net/url | fixed: 10584 known affected: 442 known not affected: 17197 | 2026-08-15T14:35:32+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3850 known affected: 67 known not affected: 11715 | 2026-08-15T14:34:20+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2839 known affected: 53 known not affected: 6259 under investigation: 1 | 2026-08-15T14:33:39+00:00 | Vulnerability · Source |
| CVE-2025-22868 | redhat_vex | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | fixed: 2199 known affected: 93 known not affected: 8426 | 2026-08-15T14:33:26+00:00 | Vulnerability · Source |
| CVE-2025-13465 | redhat_vex | lodash: prototype pollution in _.unset and _.omit functions | fixed: 673 known affected: 303 known not affected: 12232 | 2026-08-15T14:33:03+00:00 | Vulnerability · Source |
| CVE-2025-12816 | redhat_vex | node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications | fixed: 460 known affected: 37 known not affected: 2169 | 2026-08-15T14:32:40+00:00 | Vulnerability · Source |
| CVE-2025-15284 | redhat_vex | qs: qs: Denial of Service via improper input validation in array parsing | fixed: 482 known affected: 80 known not affected: 5335 | 2026-08-15T14:31:46+00:00 | Vulnerability · Source |
| CVE-2024-39338 | redhat_vex | axios: axios: Server-Side Request Forgery | fixed: 970 known affected: 20 known not affected: 738 | 2026-08-15T14:15:41+00:00 | Vulnerability · Source |
| CVE-2024-29180 | redhat_vex | webpack-dev-middleware: lack of URL validation may lead to file leak | fixed: 297 known affected: 16 known not affected: 999 | 2026-08-15T14:15:36+00:00 | Vulnerability · Source |
| CVE-2024-29041 | redhat_vex | express: cause malformed URLs to be evaluated | fixed: 227 known affected: 59 known not affected: 600 | 2026-08-15T14:15:25+00:00 | Vulnerability · Source |
| CVE-2023-46234 | redhat_vex | browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack | fixed: 1 known affected: 27 known not affected: 47 | 2026-08-15T14:15:05+00:00 | Vulnerability · Source |
| CVE-2023-46129 | redhat_vex | nkeys: xkeys Seal encryption used fixed key for all encryption | fixed: 4 known affected: 6 known not affected: 86 | 2026-08-15T14:14:48+00:00 | Vulnerability · Source |
| CVE-2023-45288 | redhat_vex | golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS | fixed: 2070 known affected: 168 known not affected: 15866 | 2026-08-15T14:14:29+00:00 | Vulnerability · Source |
| CVE-2023-39325 | redhat_vex | golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) | fixed: 6048 known affected: 223 known not affected: 30358 | 2026-08-15T14:13:51+00:00 | Vulnerability · Source |
| CVE-2023-26115 | redhat_vex | word-wrap: ReDoS | fixed: 48 known affected: 38 known not affected: 944 | 2026-08-15T14:13:37+00:00 | Vulnerability · Source |
| CVE-2023-25151 | redhat_vex | opentelemetry-go: DoS vulnerability for high cardinality metrics in otelhttp and otelbeego | known not affected: 282 | 2026-08-15T14:13:31+00:00 | Vulnerability · Source |
| CVE-2023-5332 | redhat_vex | consul: Command injection through script checks option | known affected: 20 known not affected: 55 | 2026-08-15T14:13:28+00:00 | Vulnerability · Source |
| CVE-2022-38900 | redhat_vex | decode-uri-component: improper input validation resulting in DoS | fixed: 149 known affected: 40 known not affected: 148 | 2026-08-15T14:13:16+00:00 | Vulnerability · Source |
| CVE-2022-30323 | redhat_vex | go-getter: unsafe download (issue 3 of 3) | fixed: 59 known affected: 6 known not affected: 5418 | 2026-08-15T14:13:01+00:00 | Vulnerability · Source |
| CVE-2022-30322 | redhat_vex | go-getter: unsafe download (issue 2 of 3) | fixed: 59 known affected: 6 known not affected: 5419 | 2026-08-15T14:12:24+00:00 | Vulnerability · Source |
| CVE-2022-30321 | redhat_vex | go-getter: unsafe download (issue 1 of 3) | fixed: 59 known affected: 7 known not affected: 5418 | 2026-08-15T14:12:02+00:00 | Vulnerability · Source |
| CVE-2022-26945 | redhat_vex | go-getter: command injection vulnerability | fixed: 59 known affected: 6 known not affected: 5418 | 2026-08-15T14:11:02+00:00 | Vulnerability · Source |
| CVE-2024-45338 | redhat_vex | golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html | fixed: 2839 known affected: 116 known not affected: 16024 | 2026-08-15T14:10:27+00:00 | Vulnerability · Source |
| CVE-2026-39835 | redhat_vex | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate | fixed: 849 known affected: 86 known not affected: 1921 | 2026-08-15T14:08:46+00:00 | Vulnerability · Source |
| CVE-2026-39830 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses | fixed: 975 known affected: 117 known not affected: 1120 under investigation: 3 | 2026-08-15T14:08:28+00:00 | Vulnerability · Source |
| CVE-2026-39828 | redhat_vex | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions | fixed: 419 known affected: 86 known not affected: 1966 | 2026-08-15T14:07:33+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2403 known affected: 161 known not affected: 12423 under investigation: 1 | 2026-08-15T14:07:14+00:00 | Vulnerability · Source |
| CVE-2025-21614 | redhat_vex | go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies | fixed: 527 known affected: 17 known not affected: 970 under investigation: 220 | 2026-08-15T14:05:48+00:00 | Vulnerability · Source |
| CVE-2024-48910 | redhat_vex | dompurify: DOMPurify vulnerable to tampering by prototype pollution | fixed: 937 known affected: 3 known not affected: 6477 | 2026-08-15T14:04:34+00:00 | Vulnerability · Source |
| CVE-2024-56201 | redhat_vex | jinja2: Jinja has a sandbox breakout through malicious filenames | fixed: 1161 known affected: 23 known not affected: 851 | 2026-08-15T14:00:00+00:00 | Vulnerability · Source |
| CVE-2024-45337 | redhat_vex | golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto | fixed: 1801 known affected: 74 known not affected: 8477 | 2026-08-15T13:57:27+00:00 | Vulnerability · Source |
| CVE-2023-52479 | redhat_vex | kernel: ksmbd: fix uaf in smb20_oplock_break_ack | known not affected: 198 | 2026-08-15T12:51:58+00:00 | Vulnerability · Source |
| CVE-2022-49328 | redhat_vex | kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer | fixed: 706 known affected: 38 known not affected: 118 | 2026-08-15T12:44:39+00:00 | Vulnerability · Source |
| CVE-2026-73621 | redhat_vex | gitpython: GitPython: Arbitrary File Truncation via Commit.count() Argument Injection | known affected: 51 known not affected: 5 | 2026-08-15T12:39:25+00:00 | Vulnerability · Source |
| CVE-2026-73625 | redhat_vex | gitpython: GitPython: Remote Code Execution via kwarg value smuggling | known affected: 51 known not affected: 5 | 2026-08-15T12:39:23+00:00 | Vulnerability · Source |
| CVE-2026-73619 | redhat_vex | gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` | known affected: 51 known not affected: 5 | 2026-08-15T12:39:21+00:00 | Vulnerability · Source |
| CVE-2026-73624 | redhat_vex | gitpython: GitPython: Arbitrary File Overwrite via improper git option validation | known affected: 51 known not affected: 5 | 2026-08-15T12:39:19+00:00 | Vulnerability · Source |
| CVE-2026-73623 | redhat_vex | gitpython: GitPython: Remote Code Execution via malicious Git template | known affected: 51 known not affected: 5 | 2026-08-15T12:39:18+00:00 | Vulnerability · Source |
| CVE-2026-73620 | redhat_vex | gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding | known affected: 51 known not affected: 5 | 2026-08-15T12:39:17+00:00 | Vulnerability · Source |
| CVE-2026-27459 | redhat_vex | pyOpenSSL: DTLS cookie callback buffer overflow | fixed: 103 known affected: 42 known not affected: 1487 | 2026-08-15T12:39:15+00:00 | Vulnerability · Source |