VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
224408 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-40477 | redhat_vex | thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution | fixed: 8 known affected: 5 known not affected: 67 | 2026-06-30T03:54:48+00:00 | Vulnerability · Source |
| CVE-2026-40261 | redhat_vex | composer: command injection via malicious Perforce source reference/url | fixed: 2 | 2026-06-30T03:54:41+00:00 | Vulnerability · Source |
| CVE-2026-40244 | redhat_vex | OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in EXR image processing | known not affected: 18 | 2026-06-30T03:54:36+00:00 | Vulnerability · Source |
| CVE-2026-40217 | redhat_vex | LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting | fixed: 6 known affected: 1 known not affected: 116 | 2026-06-30T03:54:34+00:00 | Vulnerability · Source |
| CVE-2026-40176 | redhat_vex | composer: command injection via malicious Perforce repository definition | fixed: 2 | 2026-06-30T03:54:27+00:00 | Vulnerability · Source |
| CVE-2026-40170 | redhat_vex | ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake | fixed: 1079 known not affected: 94 | 2026-06-30T03:54:21+00:00 | Vulnerability · Source |
| CVE-2026-39983 | redhat_vex | basic-ftp: basic-ftp: Command injection via CRLF sequences in file path parameters | fixed: 2 known affected: 2 known not affected: 5 | 2026-06-30T03:54:11+00:00 | Vulnerability · Source |
| CVE-2026-39858 | redhat_vex | traefik: Traefik: Authentication bypass via unsanitized alias headers | fixed: 4 known not affected: 57 | 2026-06-30T03:54:03+00:00 | Vulnerability · Source |
| CVE-2026-39364 | redhat_vex | vite: Vite: Information disclosure via query parameter manipulation on the development server | fixed: 4 known affected: 8 known not affected: 117 | 2026-06-30T03:53:57+00:00 | Vulnerability · Source |
| CVE-2026-39363 | redhat_vex | Vite: Vite: Information disclosure via WebSocket connection bypasses access control | fixed: 8 known affected: 9 known not affected: 597 | 2026-06-30T03:53:54+00:00 | Vulnerability · Source |
| CVE-2026-35579 | redhat_vex | github.com/coredns/coredns: CoreDNS: Authentication bypass allows unauthorized access to TSIG-protected functionalities | fixed: 4 known not affected: 31 | 2026-06-30T03:53:49+00:00 | Vulnerability · Source |
| CVE-2026-35433 | redhat_vex | dotnet: .NET: improper input validation allows an attacker to elevate privileges locally | known not affected: 133 | 2026-06-30T03:53:40+00:00 | Vulnerability · Source |
| CVE-2026-35205 | redhat_vex | github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification | fixed: 8 | 2026-06-30T03:53:32+00:00 | Vulnerability · Source |
| CVE-2026-35204 | redhat_vex | github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin | fixed: 8 | 2026-06-30T03:53:29+00:00 | Vulnerability · Source |
| CVE-2026-35093 | redhat_vex | libinput: libinput: Unauthorized code execution and information disclosure through Lua bytecode plugins | known affected: 3 known not affected: 11 | 2026-06-30T03:53:24+00:00 | Vulnerability · Source |
| CVE-2026-35051 | redhat_vex | Traefik: github.com/traefik/traefik: Traefik: Authentication bypass in ForwardAuth middleware | fixed: 4 known not affected: 57 | 2026-06-30T03:53:20+00:00 | Vulnerability · Source |
| CVE-2026-35029 | redhat_vex | litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint | fixed: 8 known affected: 1 known not affected: 121 | 2026-06-30T03:53:19+00:00 | Vulnerability · Source |
| CVE-2026-34829 | redhat_vex | rack: Rack: Denial of Service via unbounded multipart file upload | known affected: 32 known not affected: 14 | 2026-06-30T03:53:06+00:00 | Vulnerability · Source |
| CVE-2026-34827 | redhat_vex | rack: Rack: Denial of Service via crafted multipart/form-data requests | known affected: 32 known not affected: 14 | 2026-06-30T03:53:04+00:00 | Vulnerability · Source |
| CVE-2026-34785 | redhat_vex | github.com/rack/rack: Rack: Information disclosure via incorrect static file serving prefix check | known not affected: 6 | 2026-06-30T03:53:01+00:00 | Vulnerability · Source |
| CVE-2026-34780 | redhat_vex | electron: Electron: Context Isolation bypass via VideoFrame object transfer | known affected: 3 | 2026-06-30T03:53:00+00:00 | Vulnerability · Source |
| CVE-2026-34774 | redhat_vex | Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering | known affected: 3 | 2026-06-30T03:52:56+00:00 | Vulnerability · Source |
| CVE-2026-34771 | redhat_vex | electron: Electron: Memory corruption or application crash via use-after-free in permission request handling | known affected: 3 | 2026-06-30T03:52:55+00:00 | Vulnerability · Source |
| CVE-2026-34769 | redhat_vex | Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches | known affected: 3 | 2026-06-30T03:52:54+00:00 | Vulnerability · Source |
| CVE-2026-34742 | redhat_vex | github.com/modelcontextprotocol/go-sdk: Model Context Protocol (MCP) Go SDK: DNS rebinding vulnerability allows unauthorized access | fixed: 4 known affected: 7 known not affected: 59 | 2026-06-30T03:52:46+00:00 | Vulnerability · Source |
| CVE-2026-34734 | redhat_vex | hdf5: h5dump: HDF5 h5dump: Arbitrary code execution via a crafted HDF5 file | known affected: 1 | 2026-06-30T03:52:45+00:00 | Vulnerability · Source |
| CVE-2026-34714 | redhat_vex | vim: Vim: Arbitrary code execution via crafted file | known not affected: 33 | 2026-06-30T03:52:41+00:00 | Vulnerability · Source |
| CVE-2026-34601 | redhat_vex | xmldom: xmldom: XML structure injection via CDATA terminator | known not affected: 9 | 2026-06-30T03:52:41+00:00 | Vulnerability · Source |
| CVE-2026-34588 | redhat_vex | OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file | fixed: 349 known affected: 7 known not affected: 3 | 2026-06-30T03:52:38+00:00 | Vulnerability · Source |
| CVE-2026-34589 | redhat_vex | OpenEXR: OpenEXR: Memory corruption leading to arbitrary code execution or denial of service | known affected: 7 known not affected: 5 | 2026-06-30T03:52:37+00:00 | Vulnerability · Source |
| CVE-2026-34582 | redhat_vex | botan: Botan: Client authentication bypass in TLS 1.3 implementation | known affected: 2 | 2026-06-30T03:52:32+00:00 | Vulnerability · Source |
| CVE-2026-34580 | redhat_vex | Botan: Botan: Certificate validation bypass due to incorrect certificate matching | known affected: 2 | 2026-06-30T03:52:31+00:00 | Vulnerability · Source |
| CVE-2026-34545 | redhat_vex | OpenEXR: OpenEXR: Remote code execution via crafted EXR files | known affected: 3 known not affected: 9 | 2026-06-30T03:52:28+00:00 | Vulnerability · Source |
| CVE-2026-34444 | redhat_vex | lupa: Lupa: Arbitrary Code Execution due to inconsistent attribute filtering | fixed: 1 known not affected: 18 | 2026-06-30T03:52:26+00:00 | Vulnerability · Source |
| CVE-2026-34379 | redhat_vex | OpenEXR: OpenEXR: Denial of Service due to misaligned memory write during EXR file decoding | known affected: 7 known not affected: 5 | 2026-06-30T03:52:23+00:00 | Vulnerability · Source |
| CVE-2026-34282 | redhat_vex | openjdk: Enhance TLS connection handling (Oracle CPU 2026-04) | fixed: 2416 known affected: 39 known not affected: 66 | 2026-06-30T03:52:21+00:00 | Vulnerability · Source |
| CVE-2026-34226 | redhat_vex | happy-dom: Happy DOM: Information disclosure via incorrect cookie handling in fetch requests | known affected: 1 known not affected: 1 | 2026-06-30T03:52:19+00:00 | Vulnerability · Source |
| CVE-2026-34045 | redhat_vex | podman-desktop: Podman Desktop: Denial of Service and Information Disclosure via unauthenticated HTTP server | fixed: 2 known affected: 8 | 2026-06-30T03:52:11+00:00 | Vulnerability · Source |
| CVE-2026-34003 | redhat_vex | xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access | fixed: 1428 known affected: 9 | 2026-06-30T03:52:10+00:00 | Vulnerability · Source |
| CVE-2026-34001 | redhat_vex | xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption | fixed: 1428 known affected: 9 | 2026-06-30T03:52:07+00:00 | Vulnerability · Source |
| CVE-2026-33999 | redhat_vex | xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling | fixed: 1428 known affected: 9 | 2026-06-30T03:52:05+00:00 | Vulnerability · Source |
| CVE-2026-33984 | redhat_vex | FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data | fixed: 750 known affected: 12 | 2026-06-30T03:52:02+00:00 | Vulnerability · Source |
| CVE-2026-33986 | redhat_vex | FreeRDP: FreeRDP: Arbitrary code execution or denial of service via H.264 codec memory allocation vulnerability | known affected: 12 known not affected: 19 | 2026-06-30T03:52:00+00:00 | Vulnerability · Source |
| CVE-2026-33983 | redhat_vex | FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages | fixed: 750 known affected: 12 | 2026-06-30T03:51:55+00:00 | Vulnerability · Source |
| CVE-2026-33943 | redhat_vex | happy-dom: Happy DOM: Remote Code Execution via JavaScript expression injection | known affected: 1 known not affected: 1 | 2026-06-30T03:51:53+00:00 | Vulnerability · Source |
| CVE-2026-4282 | redhat_vex | keycloak: Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw | fixed: 20 | 2026-06-30T03:51:48+00:00 | Vulnerability · Source |
| CVE-2026-4154 | redhat_vex | gimp: GIMP: Remote Code Execution via XPM File Parsing Integer Overflow | fixed: 587 known affected: 6 | 2026-06-30T03:51:46+00:00 | Vulnerability · Source |
| CVE-2026-4153 | redhat_vex | gimp: GIMP: Remote Code Execution via PSP file parsing | fixed: 587 known affected: 6 | 2026-06-30T03:51:44+00:00 | Vulnerability · Source |
| CVE-2026-4152 | redhat_vex | gimp: GIMP: Remote Code Execution via malicious JP2 file parsing | fixed: 168 known affected: 24 known not affected: 5 | 2026-06-30T03:51:41+00:00 | Vulnerability · Source |
| CVE-2026-4151 | redhat_vex | gimp: GIMP: Remote Code Execution via ANI File Parsing Integer Overflow | fixed: 48 known affected: 24 known not affected: 5 | 2026-06-30T03:51:40+00:00 | Vulnerability · Source |