VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
222173 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-48817 | redhat_vex | starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods | known affected: 71 known not affected: 3 | 2026-07-16T02:10:07+00:00 | Vulnerability · Source |
| CVE-2026-53539 | redhat_vex | python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies | known affected: 9 known not affected: 3 | 2026-07-16T02:10:06+00:00 | Vulnerability · Source |
| CVE-2026-9679 | redhat_vex | undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding | fixed: 8 known affected: 72 | 2026-07-16T02:09:55+00:00 | Vulnerability · Source |
| CVE-2026-9678 | redhat_vex | undici: Undici: Information disclosure due to improper cache-control header parsing | fixed: 204 known affected: 37 known not affected: 8 | 2026-07-16T02:09:52+00:00 | Vulnerability · Source |
| CVE-2026-54283 | redhat_vex | starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | fixed: 3 known affected: 59 known not affected: 12 | 2026-07-16T02:06:47+00:00 | Vulnerability · Source |
| CVE-2026-6734 | redhat_vex | undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing | fixed: 176 known affected: 20 known not affected: 151 | 2026-07-16T02:04:18+00:00 | Vulnerability · Source |
| CVE-2022-41723 | redhat_vex | golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding | fixed: 1546 known affected: 288 known not affected: 11950 | 2026-07-16T02:02:52+00:00 | Vulnerability · Source |
| CVE-2026-44432 | redhat_vex | urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | fixed: 126 known affected: 62 known not affected: 694 | 2026-07-16T01:40:58+00:00 | Vulnerability · Source |
| CVE-2026-59831 | microsoft_vex | GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace | fixed: 1 known affected: 1 | 2026-07-16T01:39:07+00:00 | Vulnerability · Source |
| CVE-2026-1609 | redhat_vex | org.keycloak/keycloak-quarkus-server: Keycloak: Unauthorized Access via JWT authorization grant with disabled users | known not affected: 6 | 2026-07-16T01:05:52+00:00 | Vulnerability · Source |
| CVE-2026-48863 | redhat_vex | libsolv: Stack-based buffer overflow in libsolv EdDSA PGP signature verification allows denial of service | known not affected: 29 | 2026-07-16T01:05:50+00:00 | Vulnerability · Source |
| CVE-2026-3842 | redhat_vex | qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write | known not affected: 82 | 2026-07-16T01:05:49+00:00 | Vulnerability · Source |
| CVE-2026-23538 | redhat_vex | feast: Resource exhaustion via WebSocket endpoint | known not affected: 14 | 2026-07-16T01:05:46+00:00 | Vulnerability · Source |
| CVE-2026-45292 | redhat_vex | opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage | fixed: 10 known affected: 30 known not affected: 85 under investigation: 17 | 2026-07-16T00:40:49+00:00 | Vulnerability · Source |
| CVE-2026-46385 | redhat_vex | github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration | fixed: 8 known affected: 3 known not affected: 353 | 2026-07-16T00:09:04+00:00 | Vulnerability · Source |
| CVE-2026-46384 | redhat_vex | github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder | fixed: 8 known affected: 3 known not affected: 353 | 2026-07-16T00:08:58+00:00 | Vulnerability · Source |
| CVE-2026-21721 | redhat_vex | grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation | fixed: 80 known affected: 10 known not affected: 519 | 2026-07-16T00:07:58+00:00 | Vulnerability · Source |
| CVE-2025-9288 | redhat_vex | sha.js: Missing type checks leading to hash rewind and passing on crafted data | fixed: 71 known affected: 15 known not affected: 1305 | 2026-07-16T00:07:58+00:00 | Vulnerability · Source |
| CVE-2026-25639 | redhat_vex | axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig | fixed: 170 known affected: 34 known not affected: 3907 | 2026-07-16T00:07:58+00:00 | Vulnerability · Source |
| CVE-2026-48801 | redhat_vex | linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability | fixed: 4 known affected: 20 under investigation: 8 | 2026-07-15T23:36:38+00:00 | Vulnerability · Source |
| CVE-2026-53486 | redhat_vex | decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction | fixed: 3 known affected: 3 | 2026-07-15T21:56:40+00:00 | Vulnerability · Source |
| CVE-2026-47241 | redhat_vex | net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input | fixed: 12 known not affected: 133 | 2026-07-15T21:43:19+00:00 | Vulnerability · Source |
| CVE-2026-47240 | redhat_vex | net-imap: Net::IMAP: Command injection via non-synchronizing literals | fixed: 8 known affected: 124 known not affected: 10 | 2026-07-15T21:43:19+00:00 | Vulnerability · Source |
| CVE-2026-48935 | redhat_vex | nodejs: Node.js: Unauthorized file metadata modification | fixed: 212 known affected: 14 | 2026-07-15T20:47:30+00:00 | Vulnerability · Source |
| CVE-2026-32281 | redhat_vex | crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | fixed: 1129 known affected: 259 known not affected: 1130 | 2026-07-15T20:42:13+00:00 | Vulnerability · Source |
| CVE-2025-47907 | redhat_vex | database/sql: Postgres Scan Race Condition | fixed: 5222 known affected: 165 known not affected: 2217 | 2026-07-15T20:42:05+00:00 | Vulnerability · Source |
| CVE-2026-48934 | redhat_vex | nodejs: Node.js: Certification validation bypass in TLS host verification | fixed: 212 known affected: 14 | 2026-07-15T20:41:17+00:00 | Vulnerability · Source |
| CVE-2026-48930 | redhat_vex | nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling | fixed: 212 known affected: 14 | 2026-07-15T20:41:12+00:00 | Vulnerability · Source |
| CVE-2026-48928 | redhat_vex | Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency | fixed: 212 known affected: 14 | 2026-07-15T20:41:09+00:00 | Vulnerability · Source |
| CVE-2026-48619 | redhat_vex | nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames | fixed: 212 known affected: 14 | 2026-07-15T20:41:06+00:00 | Vulnerability · Source |
| CVE-2026-48615 | redhat_vex | nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling | fixed: 250 known affected: 14 | 2026-07-15T20:41:04+00:00 | Vulnerability · Source |
| CVE-2026-32282 | redhat_vex | golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root | fixed: 1170 known affected: 190 known not affected: 1824 | 2026-07-15T20:36:12+00:00 | Vulnerability · Source |
| CVE-2026-33810 | redhat_vex | crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application | fixed: 119 known affected: 149 known not affected: 939 | 2026-07-15T20:30:25+00:00 | Vulnerability · Source |
| CVE-2026-15685 | redhat_vex | Ollama: Ollama: Denial of Service via improper array index validation in downloadBlob function | known not affected: 4 | 2026-07-15T20:23:47+00:00 | Vulnerability · Source |
| CVE-2026-15308 | redhat_vex | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations | fixed: 302 known affected: 63 known not affected: 34 | 2026-07-15T20:20:03+00:00 | Vulnerability · Source |
| CVE-2026-48933 | redhat_vex | nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() | fixed: 250 known affected: 14 | 2026-07-15T20:18:01+00:00 | Vulnerability · Source |
| CVE-2026-48618 | redhat_vex | nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch | fixed: 250 known affected: 14 | 2026-07-15T20:17:55+00:00 | Vulnerability · Source |
| CVE-2026-42338 | redhat_vex | ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input | fixed: 284 known affected: 21 known not affected: 220 | 2026-07-15T20:17:48+00:00 | Vulnerability · Source |
| CVE-2026-27137 | redhat_vex | crypto/x509: Incorrect enforcement of email constraints in crypto/x509 | fixed: 329 known affected: 134 known not affected: 1117 | 2026-07-15T20:13:49+00:00 | Vulnerability · Source |
| CVE-2026-42044 | redhat_vex | axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget | fixed: 135 known affected: 49 known not affected: 1455 | 2026-07-15T20:01:39+00:00 | Vulnerability · Source |
| CVE-2026-42039 | redhat_vex | axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data | fixed: 141 known affected: 38 known not affected: 2478 | 2026-07-15T20:01:06+00:00 | Vulnerability · Source |
| CVE-2026-62294 | redhat_vex | flameshot: Flameshot: Local file overwrite via time-of-check to time-of-use race condition | known not affected: 1 | 2026-07-15T19:22:35+00:00 | Vulnerability · Source |
| CVE-2026-45822 | redhat_vex | decode-uri-component: decode-uri-component: Denial of Service via crafted input | fixed: 3 known affected: 12 known not affected: 49 | 2026-07-15T19:19:49+00:00 | Vulnerability · Source |
| CVE-2026-13676 | redhat_vex | fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization | fixed: 19 known affected: 89 known not affected: 1477 | 2026-07-15T19:18:49+00:00 | Vulnerability · Source |
| CVE-2026-12143 | redhat_vex | form-data: form-data: Form field override via CRLF injection | fixed: 100 known affected: 49 known not affected: 176 under investigation: 108 | 2026-07-15T19:18:49+00:00 | Vulnerability · Source |
| CVE-2026-32591 | redhat_vex | mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration | fixed: 7 known affected: 2 known not affected: 46 | 2026-07-15T19:18:49+00:00 | Vulnerability · Source |
| CVE-2026-47158 | redhat_vex | vaultwarden: Vaultwarden: Account takeover via SSO authorization flow vulnerability | known not affected: 1 | 2026-07-15T19:05:55+00:00 | Vulnerability · Source |
| CVE-2026-2100 | redhat_vex | p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters | fixed: 149 known not affected: 14 under investigation: 1 | 2026-07-15T18:40:48+00:00 | Vulnerability · Source |
| CVE-2026-42010 | redhat_vex | gnutls: gnutls: Authentication Bypass via NUL Character in Username | fixed: 717 known affected: 1 known not affected: 66 | 2026-07-15T18:36:05+00:00 | Vulnerability · Source |
| CVE-2026-4438 | redhat_vex | glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions | fixed: 2028 known affected: 237 known not affected: 2 under investigation: 1 | 2026-07-15T18:31:20+00:00 | Vulnerability · Source |