VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
224354 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-43997 | redhat_vex | vm2: vm2: Arbitrary code execution via sandbox escape | known affected: 1 known not affected: 1 | 2026-06-30T03:58:49+00:00 | Vulnerability · Source |
| CVE-2026-43964 | redhat_vex | postfix: buffer over-read via malformed enhanced status code | fixed: 251 known affected: 6 | 2026-06-30T03:58:46+00:00 | Vulnerability · Source |
| CVE-2026-43824 | redhat_vex | github.com/argoproj/argo-cd/: Argo CD: Information disclosure via ServerSideDiff allows reading Kubernetes Secret data | known affected: 1 known not affected: 10 | 2026-06-30T03:58:45+00:00 | Vulnerability · Source |
| CVE-2026-43658 | redhat_vex | webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash | fixed: 371 known affected: 4 known not affected: 5 | 2026-06-30T03:58:42+00:00 | Vulnerability · Source |
| CVE-2026-43618 | redhat_vex | rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding | fixed: 46 known affected: 5 known not affected: 2 | 2026-06-30T03:58:40+00:00 | Vulnerability · Source |
| CVE-2026-43494 | redhat_vex | kernel: net/rds: reset op_nents when zerocopy page pin fails | known not affected: 274 | 2026-06-30T03:58:33+00:00 | Vulnerability · Source |
| CVE-2026-43178 | redhat_vex | kernel: procfs: fix possible double mmput() in do_procmap_query() | known not affected: 260 under investigation: 14 | 2026-06-30T03:58:28+00:00 | Vulnerability · Source |
| CVE-2026-43038 | redhat_vex | kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() | fixed: 1980 known affected: 22 known not affected: 42 | 2026-06-30T03:58:16+00:00 | Vulnerability · Source |
| CVE-2026-43003 | redhat_vex | ironic-python-agent: OpenStack ironic-python-agent: Arbitrary code execution via malicious image | known affected: 2 | 2026-06-30T03:58:15+00:00 | Vulnerability · Source |
| CVE-2026-42965 | redhat_vex | openshift/router: openshift/router: cloud metadata SSRF via FQDN-typed EndpointSlice bypasses destination validation | known affected: 2 | 2026-06-30T03:58:03+00:00 | Vulnerability · Source |
| CVE-2026-42959 | redhat_vex | unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages | fixed: 183 known affected: 11 | 2026-06-30T03:58:02+00:00 | Vulnerability · Source |
| CVE-2026-42944 | redhat_vex | unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options | fixed: 183 known affected: 11 | 2026-06-30T03:57:58+00:00 | Vulnerability · Source |
| CVE-2026-42899 | redhat_vex | dotnet: .NET: infinite loop allows an attacker to cause a denial of service | fixed: 1437 known not affected: 6 | 2026-06-30T03:57:55+00:00 | Vulnerability · Source |
| CVE-2026-42573 | redhat_vex | svelte: Svelte: Cross-Site Scripting via DOM Clobbering | known not affected: 1 | 2026-06-30T03:57:44+00:00 | Vulnerability · Source |
| CVE-2026-42296 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Privilege escalation via security control bypass | known affected: 7 | 2026-06-30T03:57:30+00:00 | Vulnerability · Source |
| CVE-2026-42294 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor | known affected: 2 | 2026-06-30T03:57:26+00:00 | Vulnerability · Source |
| CVE-2026-42271 | redhat_vex | litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints | fixed: 8 known not affected: 19 | 2026-06-30T03:57:25+00:00 | Vulnerability · Source |
| CVE-2026-42203 | redhat_vex | litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates | known affected: 1 known not affected: 2 | 2026-06-30T03:57:10+00:00 | Vulnerability · Source |
| CVE-2026-41731 | redhat_vex | spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header values | known affected: 2 | 2026-06-30T03:56:36+00:00 | Vulnerability · Source |
| CVE-2026-41651 | redhat_vex | PackageKit: race condition vulnerability leads to arbitrary package installation as root | fixed: 941 known not affected: 17 | 2026-06-30T03:56:23+00:00 | Vulnerability · Source |
| CVE-2026-41481 | redhat_vex | langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass | known affected: 7 | 2026-06-30T03:56:15+00:00 | Vulnerability · Source |
| CVE-2026-41246 | redhat_vex | Contour: Envoy: github.com/projectcontour/contour: Contour: Arbitrary Code Execution and Denial of Service via Lua Code Injection | known not affected: 2 | 2026-06-30T03:56:03+00:00 | Vulnerability · Source |
| CVE-2026-41245 | redhat_vex | junrar: Junrar: Arbitrary file write via path traversal when extracting crafted RAR archives. | known affected: 1 known not affected: 2 | 2026-06-30T03:56:00+00:00 | Vulnerability · Source |
| CVE-2026-41179 | redhat_vex | github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint | known not affected: 4 | 2026-06-30T03:55:58+00:00 | Vulnerability · Source |
| CVE-2026-41176 | redhat_vex | github.com/rclone/rclone: Rclone: Unauthorized access to administrative functions through unauthenticated Remote Control endpoint. | known not affected: 4 | 2026-06-30T03:55:54+00:00 | Vulnerability · Source |
| CVE-2026-41163 | redhat_vex | bubblewrap: bubblewrap: Privilege escalation via ptrace when installed in setuid mode | known not affected: 6 | 2026-06-30T03:55:53+00:00 | Vulnerability · Source |
| CVE-2026-41139 | redhat_vex | mathjs: math.js: Arbitrary code execution via expression parser | known not affected: 41 | 2026-06-30T03:55:51+00:00 | Vulnerability · Source |
| CVE-2026-41140 | redhat_vex | poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction | fixed: 8 known affected: 2 known not affected: 112 | 2026-06-30T03:55:49+00:00 | Vulnerability · Source |
| CVE-2026-40982 | redhat_vex | Spring Cloud Config: spring-cloud-config-server: Spring Cloud Config: Directory traversal allows arbitrary file access | known not affected: 5 | 2026-06-30T03:55:30+00:00 | Vulnerability · Source |
| CVE-2026-40981 | redhat_vex | Spring Cloud Config: Spring Cloud Config: Information disclosure of secrets from unintended GCP projects | known not affected: 5 | 2026-06-30T03:55:25+00:00 | Vulnerability · Source |
| CVE-2026-40976 | redhat_vex | Spring Boot: Spring Boot: Security bypass due to ineffective default web security | known affected: 1 known not affected: 28 | 2026-06-30T03:55:24+00:00 | Vulnerability · Source |
| CVE-2026-40975 | redhat_vex | Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. | fixed: 11 known affected: 3 known not affected: 66 | 2026-06-30T03:55:20+00:00 | Vulnerability · Source |
| CVE-2026-40912 | redhat_vex | github.com/traefik/traefik: Traefik: Authentication bypass via crafted URL dot-segments in StripPrefixRegex middleware | fixed: 4 known not affected: 57 | 2026-06-30T03:55:14+00:00 | Vulnerability · Source |
| CVE-2026-40906 | redhat_vex | electric-sql: ElectricSQL: Critical data compromise and loss via SQL injection | known not affected: 1 | 2026-06-30T03:55:09+00:00 | Vulnerability · Source |
| CVE-2026-40897 | redhat_vex | mathjs: Math.js: Arbitrary code execution via expression parser | known not affected: 40 | 2026-06-30T03:55:06+00:00 | Vulnerability · Source |
| CVE-2026-40886 | redhat_vex | github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via malformed workflow pod annotation | known not affected: 14 | 2026-06-30T03:55:00+00:00 | Vulnerability · Source |
| CVE-2026-40611 | redhat_vex | github.com/go-acme/lego: Lego: Arbitrary file write and deletion via path traversal from a malicious ACME server | fixed: 4 known not affected: 57 | 2026-06-30T03:54:58+00:00 | Vulnerability · Source |
| CVE-2026-40575 | redhat_vex | oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header | known affected: 1 | 2026-06-30T03:54:55+00:00 | Vulnerability · Source |
| CVE-2026-40478 | redhat_vex | thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass | fixed: 8 known affected: 5 known not affected: 67 | 2026-06-30T03:54:51+00:00 | Vulnerability · Source |
| CVE-2026-40477 | redhat_vex | thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution | fixed: 8 known affected: 5 known not affected: 67 | 2026-06-30T03:54:48+00:00 | Vulnerability · Source |
| CVE-2026-40261 | redhat_vex | composer: command injection via malicious Perforce source reference/url | fixed: 2 | 2026-06-30T03:54:41+00:00 | Vulnerability · Source |
| CVE-2026-40244 | redhat_vex | OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in EXR image processing | known not affected: 18 | 2026-06-30T03:54:36+00:00 | Vulnerability · Source |
| CVE-2026-40217 | redhat_vex | LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting | fixed: 6 known affected: 1 known not affected: 116 | 2026-06-30T03:54:34+00:00 | Vulnerability · Source |
| CVE-2026-40176 | redhat_vex | composer: command injection via malicious Perforce repository definition | fixed: 2 | 2026-06-30T03:54:27+00:00 | Vulnerability · Source |
| CVE-2026-40170 | redhat_vex | ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake | fixed: 1079 known not affected: 94 | 2026-06-30T03:54:21+00:00 | Vulnerability · Source |
| CVE-2026-39983 | redhat_vex | basic-ftp: basic-ftp: Command injection via CRLF sequences in file path parameters | fixed: 2 known affected: 2 known not affected: 5 | 2026-06-30T03:54:11+00:00 | Vulnerability · Source |
| CVE-2026-39858 | redhat_vex | traefik: Traefik: Authentication bypass via unsanitized alias headers | fixed: 4 known not affected: 57 | 2026-06-30T03:54:03+00:00 | Vulnerability · Source |
| CVE-2026-39364 | redhat_vex | vite: Vite: Information disclosure via query parameter manipulation on the development server | fixed: 4 known affected: 8 known not affected: 117 | 2026-06-30T03:53:57+00:00 | Vulnerability · Source |
| CVE-2026-39363 | redhat_vex | Vite: Vite: Information disclosure via WebSocket connection bypasses access control | fixed: 8 known affected: 9 known not affected: 597 | 2026-06-30T03:53:54+00:00 | Vulnerability · Source |
| CVE-2026-35579 | redhat_vex | github.com/coredns/coredns: CoreDNS: Authentication bypass allows unauthorized access to TSIG-protected functionalities | fixed: 4 known not affected: 31 | 2026-06-30T03:53:49+00:00 | Vulnerability · Source |