VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
290591 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-25681 | redhat_vex | golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting | fixed: 822 known affected: 315 known not affected: 3206 | 2026-08-23T20:29:59+00:00 | Vulnerability · Source |
| CVE-2021-20329 | redhat_vex | mongo-go-driver: specific cstrings input may not be properly validated | fixed: 252 known affected: 69 known not affected: 3782 | 2026-08-23T20:28:10+00:00 | Vulnerability · Source |
| CVE-2026-33036 | redhat_vex | fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass | fixed: 610 known affected: 7 known not affected: 189 | 2026-08-23T20:26:35+00:00 | Vulnerability · Source |
| CVE-2026-27942 | redhat_vex | fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service | fixed: 333 known affected: 4 known not affected: 143 | 2026-08-23T20:26:26+00:00 | Vulnerability · Source |
| CVE-2026-25128 | redhat_vex | fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug | fixed: 243 known affected: 12 known not affected: 124 | 2026-08-23T20:26:12+00:00 | Vulnerability · Source |
| CVE-2026-27136 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass | fixed: 805 known affected: 254 known not affected: 4413 | 2026-08-23T20:25:45+00:00 | Vulnerability · Source |
| CVE-2026-21441 | redhat_vex | urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) | fixed: 1947 known affected: 385 known not affected: 2923 under investigation: 1 | 2026-08-23T20:25:18+00:00 | Vulnerability · Source |
| CVE-2025-66506 | redhat_vex | github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token | fixed: 329 known affected: 45 known not affected: 1294 | 2026-08-23T20:25:05+00:00 | Vulnerability · Source |
| CVE-2025-66471 | redhat_vex | urllib3: urllib3 Streaming API improperly handles highly compressed data | fixed: 1957 known affected: 347 known not affected: 3325 under investigation: 1 | 2026-08-23T20:24:57+00:00 | Vulnerability · Source |
| CVE-2025-66418 | redhat_vex | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | fixed: 1941 known affected: 413 known not affected: 2590 under investigation: 1 | 2026-08-23T20:24:46+00:00 | Vulnerability · Source |
| CVE-2025-64756 | redhat_vex | glob: glob: Command Injection Vulnerability via Malicious Filenames | fixed: 171 known affected: 115 known not affected: 1097 | 2026-08-23T20:24:39+00:00 | Vulnerability · Source |
| CVE-2025-61729 | redhat_vex | crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | fixed: 8083 known affected: 431 known not affected: 4939 under investigation: 2 | 2026-08-23T20:24:32+00:00 | Vulnerability · Source |
| CVE-2025-52881 | redhat_vex | runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | fixed: 2410 known affected: 45 known not affected: 4360 | 2026-08-23T20:24:24+00:00 | Vulnerability · Source |
| CVE-2025-48379 | redhat_vex | python-pillow: pillow: Pillow DDS Heap Buffer Overflow | fixed: 12 known affected: 18 known not affected: 45 | 2026-08-23T20:24:22+00:00 | Vulnerability · Source |
| CVE-2025-30204 | redhat_vex | golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | fixed: 3850 known affected: 66 known not affected: 11715 | 2026-08-23T20:24:10+00:00 | Vulnerability · Source |
| CVE-2025-27516 | redhat_vex | jinja2: Jinja sandbox breakout through attr filter selecting format method | fixed: 1017 known affected: 21 known not affected: 2408 under investigation: 6 | 2026-08-23T20:24:08+00:00 | Vulnerability · Source |
| CVE-2025-22869 | redhat_vex | golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh | fixed: 2839 known affected: 53 known not affected: 6259 under investigation: 1 | 2026-08-23T20:24:01+00:00 | Vulnerability · Source |
| CVE-2025-22868 | redhat_vex | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | fixed: 2199 known affected: 93 known not affected: 8426 | 2026-08-23T20:24:00+00:00 | Vulnerability · Source |
| CVE-2025-12816 | redhat_vex | node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications | fixed: 460 known affected: 37 known not affected: 2169 | 2026-08-23T20:23:57+00:00 | Vulnerability · Source |
| CVE-2024-56201 | redhat_vex | jinja2: Jinja has a sandbox breakout through malicious filenames | fixed: 1161 known affected: 23 known not affected: 851 | 2026-08-23T20:23:51+00:00 | Vulnerability · Source |
| CVE-2024-45590 | redhat_vex | body-parser: Denial of Service Vulnerability in body-parser | fixed: 425 known affected: 35 known not affected: 913 | 2026-08-23T20:23:49+00:00 | Vulnerability · Source |
| CVE-2024-45337 | redhat_vex | golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto | fixed: 1801 known affected: 74 known not affected: 8478 | 2026-08-23T20:23:45+00:00 | Vulnerability · Source |
| CVE-2025-58754 | redhat_vex | axios: Axios DoS via lack of data size check | fixed: 361 known affected: 41 known not affected: 1163 | 2026-08-23T20:22:34+00:00 | Vulnerability · Source |
| CVE-2025-68121 | redhat_vex | crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | fixed: 7473 known affected: 194 known not affected: 4387 under investigation: 42 | 2026-08-23T20:20:28+00:00 | Vulnerability · Source |
| CVE-2025-66031 | redhat_vex | node-forge: node-forge ASN.1 Unbounded Recursion | fixed: 381 known affected: 43 known not affected: 1767 | 2026-08-23T20:20:05+00:00 | Vulnerability · Source |
| CVE-2026-42502 | redhat_vex | golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering | fixed: 237 known affected: 334 known not affected: 955 | 2026-08-23T20:19:39+00:00 | Vulnerability · Source |
| CVE-2026-32282 | redhat_vex | golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root | fixed: 1440 known affected: 173 known not affected: 2206 | 2026-08-23T20:17:08+00:00 | Vulnerability · Source |
| CVE-2026-32281 | redhat_vex | crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | fixed: 2067 known affected: 184 known not affected: 2106 | 2026-08-23T20:17:03+00:00 | Vulnerability · Source |
| CVE-2026-0915 | redhat_vex | glibc: glibc: Information disclosure via zero-valued network query | fixed: 2047 known affected: 22 known not affected: 1008 | 2026-08-23T20:15:51+00:00 | Vulnerability · Source |
| CVE-2026-45445 | redhat_vex | openssl: AES-OCB IV Ignored on EVP_Cipher() Path | fixed: 104 known affected: 1 known not affected: 52 | 2026-08-23T20:14:55+00:00 | Vulnerability · Source |
| CVE-2026-42764 | redhat_vex | openssl: NULL pointer dereference in QUIC server initial packet handling | fixed: 104 known affected: 24 known not affected: 29 | 2026-08-23T20:14:51+00:00 | Vulnerability · Source |
| CVE-2026-34183 | redhat_vex | openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler | fixed: 104 known affected: 1 known not affected: 52 | 2026-08-23T20:14:41+00:00 | Vulnerability · Source |
| CVE-2026-34182 | redhat_vex | openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages | fixed: 104 known affected: 1 known not affected: 52 | 2026-08-23T20:14:35+00:00 | Vulnerability · Source |
| CVE-2026-5450 | redhat_vex | glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width | fixed: 8733 known affected: 3 known not affected: 6 | 2026-08-23T20:14:26+00:00 | Vulnerability · Source |
| CVE-2025-5278 | redhat_vex | coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification | fixed: 90 known affected: 9 known not affected: 18 | 2026-08-23T20:14:22+00:00 | Vulnerability · Source |
| CVE-2025-69419 | redhat_vex | openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing | fixed: 553 known affected: 5 known not affected: 220 | 2026-08-23T20:13:54+00:00 | Vulnerability · Source |
| CVE-2025-11187 | redhat_vex | openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file | fixed: 124 known affected: 25 known not affected: 62 | 2026-08-23T20:13:53+00:00 | Vulnerability · Source |
| CVE-2025-61728 | redhat_vex | golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip | fixed: 7014 known affected: 110 known not affected: 4132 | 2026-08-23T20:13:01+00:00 | Vulnerability · Source |
| CVE-2023-39325 | redhat_vex | golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) | fixed: 6046 known affected: 223 known not affected: 30360 | 2026-08-23T20:09:22+00:00 | Vulnerability · Source |
| CVE-2024-11831 | redhat_vex | npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript | fixed: 1160 known affected: 128 known not affected: 1595 | 2026-08-23T20:09:04+00:00 | Vulnerability · Source |
| CVE-2024-21536 | redhat_vex | http-proxy-middleware: Denial of Service | fixed: 253 known affected: 59 known not affected: 959 | 2026-08-23T20:06:15+00:00 | Vulnerability · Source |
| CVE-2025-27144 | redhat_vex | go-jose: Go JOSE's Parsing Vulnerable to Denial of Service | fixed: 1030 known affected: 24 known not affected: 5241 | 2026-08-23T20:04:09+00:00 | Vulnerability · Source |
| CVE-2026-34986 | redhat_vex | github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object | fixed: 2740 known affected: 156 known not affected: 13124 under investigation: 1 | 2026-08-23T20:02:20+00:00 | Vulnerability · Source |
| CVE-2025-58183 | redhat_vex | golang: archive/tar: Unbounded allocation when parsing GNU sparse map | fixed: 8922 known affected: 125 known not affected: 8350 | 2026-08-23T20:01:20+00:00 | Vulnerability · Source |
| CVE-2025-68973 | redhat_vex | GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write | fixed: 394 known affected: 3 known not affected: 149 | 2026-08-23T19:41:00+00:00 | Vulnerability · Source |
| CVE-2025-66564 | redhat_vex | github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing | fixed: 41 known affected: 18 known not affected: 358 | 2026-08-23T19:40:57+00:00 | Vulnerability · Source |
| CVE-2025-15284 | redhat_vex | qs: qs: Denial of Service via improper input validation in array parsing | fixed: 482 known affected: 80 known not affected: 5335 | 2026-08-23T19:40:33+00:00 | Vulnerability · Source |
| CVE-2026-53488 | redhat_vex | github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin | fixed: 339 known affected: 85 known not affected: 892 | 2026-08-23T19:40:19+00:00 | Vulnerability · Source |
| CVE-2026-32280 | redhat_vex | crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | fixed: 3402 known affected: 166 known not affected: 3360 | 2026-08-23T19:40:14+00:00 | Vulnerability · Source |
| CVE-2026-53492 | redhat_vex | github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. | fixed: 279 known affected: 96 known not affected: 362 | 2026-08-23T19:40:05+00:00 | Vulnerability · Source |