VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
305813 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2023-39322 | redhat_vex | golang: crypto/tls: lack of a limit on buffered post-handshake | fixed: 996 known affected: 70 known not affected: 1276 | 2026-10-08T11:49:33+00:00 | Vulnerability · Source |
| CVE-2023-39321 | redhat_vex | golang: crypto/tls: panic when processing post-handshake message on QUIC connections | fixed: 1022 known affected: 106 known not affected: 1213 | 2026-10-08T11:49:27+00:00 | Vulnerability · Source |
| CVE-2023-39319 | redhat_vex | golang: html/template: improper handling of special tags within script contexts | fixed: 946 known affected: 52 known not affected: 1278 under investigation: 2 | 2026-10-08T11:49:26+00:00 | Vulnerability · Source |
| CVE-2023-39318 | redhat_vex | golang: html/template: improper handling of HTML-like comments within script contexts | fixed: 972 known affected: 52 known not affected: 1252 | 2026-10-08T11:49:25+00:00 | Vulnerability · Source |
| CVE-2024-21501 | redhat_vex | sanitize-html: Information Exposure when used on the backend | fixed: 28 known affected: 4 known not affected: 910 | 2026-10-08T11:49:07+00:00 | Vulnerability · Source |
| CVE-2024-30255 | redhat_vex | envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood | fixed: 53 known affected: 15 known not affected: 24 | 2026-10-08T11:49:00+00:00 | Vulnerability · Source |
| CVE-2024-28863 | redhat_vex | node-tar: denial of service while parsing a tar file due to lack of folders depth validation | fixed: 220 known affected: 37 known not affected: 240 | 2026-10-08T11:48:50+00:00 | Vulnerability · Source |
| CVE-2024-28849 | redhat_vex | follow-redirects: Possible credential leak | fixed: 341 known affected: 25 known not affected: 1370 | 2026-10-08T11:48:35+00:00 | Vulnerability · Source |
| CVE-2023-48631 | redhat_vex | css-tools: regular expression denial of service (ReDoS) when parsing CSS | fixed: 23 known affected: 10 known not affected: 106 | 2026-10-08T11:42:38+00:00 | Vulnerability · Source |
| CVE-2023-26364 | redhat_vex | css-tools: Improper Input Validation causes Denial of Service via Regular Expression | fixed: 31 known affected: 8 known not affected: 391 | 2026-10-08T11:42:33+00:00 | Vulnerability · Source |
| CVE-2024-24784 | redhat_vex | golang: net/mail: comments in display names are incorrectly handled | fixed: 1678 known affected: 57 known not affected: 714 | 2026-10-08T11:42:25+00:00 | Vulnerability · Source |
| CVE-2024-24788 | redhat_vex | golang: net: malformed DNS message can cause infinite loop | fixed: 895 known affected: 86 known not affected: 406 | 2026-10-08T11:42:24+00:00 | Vulnerability · Source |
| CVE-2026-103006 | redhat_vex | elasticsearch: Elasticsearch: Denial of Service via deeply nested search aggregations | known affected: 1 known not affected: 2 | 2026-10-08T11:35:45+00:00 | Vulnerability · Source |
| CVE-2026-102407 | redhat_vex | elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API | known affected: 1 known not affected: 2 | 2026-10-08T11:35:43+00:00 | Vulnerability · Source |
| CVE-2026-98358 | redhat_vex | kernel: IB/iser: reject a remote invalidation of an unregistered direction | known affected: 277 | 2026-10-08T11:35:40+00:00 | Vulnerability · Source |
| CVE-2026-67241 | redhat_vex | rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check | fixed: 3 known not affected: 8 | 2026-10-08T11:35:38+00:00 | Vulnerability · Source |
| CVE-2019-25210 | redhat_vex | helm: shows secrets with --dry-run option in clear text | fixed: 82 known affected: 2 known not affected: 1522 | 2026-10-08T11:35:01+00:00 | Vulnerability · Source |
| CVE-2026-103009 | redhat_vex | elasticsearch: Elasticsearch: Information disclosure via crafted cross-cluster search requests | known affected: 1 known not affected: 2 | 2026-10-08T11:34:57+00:00 | Vulnerability · Source |
| CVE-2026-91777 | redhat_vex | com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion | known affected: 22 known not affected: 144 | 2026-10-08T11:34:54+00:00 | Vulnerability · Source |
| CVE-2026-84637 | redhat_vex | thunderbird: Thunderbird: Arbitrary code execution via malicious calendar invitation attachments | known not affected: 6 | 2026-10-08T11:34:52+00:00 | Vulnerability · Source |
| CVE-2026-84125 | redhat_vex | firefox: Firefox: Arbitrary code execution via use-after-free in DOM: Core & HTML | known not affected: 9 | 2026-10-08T11:34:47+00:00 | Vulnerability · Source |
| CVE-2024-25620 | redhat_vex | helm: Dependency management path traversal | fixed: 82 known affected: 7 known not affected: 1181 | 2026-10-08T11:34:02+00:00 | Vulnerability · Source |
| CVE-2024-26147 | redhat_vex | helm: Missing YAML Content Leads To Panic | fixed: 122 known affected: 10 known not affected: 2499 | 2026-10-08T11:34:02+00:00 | Vulnerability · Source |
| CVE-2026-92000 | redhat_vex | adm-zip: adm-zip: Denial of Service via crafted ZIP archives with zero declared uncompressed size | fixed: 30 known affected: 18 known not affected: 77 | 2026-10-08T11:33:58+00:00 | Vulnerability · Source |
| CVE-2026-98364 | redhat_vex | kernel: xfrm: hold net_device reference under RCU in bundle creation | known affected: 263 under investigation: 14 | 2026-10-08T11:33:29+00:00 | Vulnerability · Source |
| CVE-2026-89059 | redhat_vex | resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) | known affected: 91 | 2026-10-08T11:32:25+00:00 | Vulnerability · Source |
| CVE-2023-27561 | redhat_vex | runc: volume mount race condition (regression of CVE-2019-19921) | fixed: 556 known affected: 40 known not affected: 1666 | 2026-10-08T11:28:59+00:00 | Vulnerability · Source |
| CVE-2021-36157 | redhat_vex | cortex: Grafana Cortex directory traversal | fixed: 8 known affected: 3 known not affected: 830 | 2026-10-08T11:28:54+00:00 | Vulnerability · Source |
| CVE-2026-80521 | redhat_vex | kernel: af_unix: Unlink scc_entry in unix_del_edge() | fixed: 307 known affected: 77 known not affected: 198 | 2026-10-08T11:21:44+00:00 | Vulnerability · Source |
| CVE-2026-64007 | redhat_vex | kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable | fixed: 1235 known affected: 127 known not affected: 15 | 2026-10-08T11:21:41+00:00 | Vulnerability · Source |
| CVE-2026-52924 | redhat_vex | kernel: sctp: purge outqueue on stale COOKIE-ECHO handling | fixed: 2122 known affected: 22 known not affected: 42 | 2026-10-08T11:21:34+00:00 | Vulnerability · Source |
| CVE-2026-64582 | redhat_vex | kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap | fixed: 1305 known affected: 50 known not affected: 91 | 2026-10-08T11:21:19+00:00 | Vulnerability · Source |
| CVE-2026-64386 | redhat_vex | kernel: smb: client: fix query_info() replay double-free | fixed: 1224 known affected: 22 known not affected: 91 | 2026-10-08T11:21:14+00:00 | Vulnerability · Source |
| CVE-2026-64383 | redhat_vex | kernel: smb: client: fix double-free in SMB2_flush() replay | fixed: 1224 known affected: 22 known not affected: 90 | 2026-10-08T11:21:05+00:00 | Vulnerability · Source |
| CVE-2026-88815 | redhat_vex | perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting | fixed: 36 known affected: 4 | 2026-10-08T11:20:54+00:00 | Vulnerability · Source |
| CVE-2026-91964 | redhat_vex | FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU | fixed: 195 known affected: 12 | 2026-10-08T11:20:50+00:00 | Vulnerability · Source |
| CVE-2026-91963 | redhat_vex | FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure | fixed: 195 known affected: 12 | 2026-10-08T11:20:37+00:00 | Vulnerability · Source |
| CVE-2024-45338 | redhat_vex | golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html | fixed: 2836 known affected: 126 known not affected: 16031 | 2026-10-08T11:14:46+00:00 | Vulnerability · Source |
| CVE-2025-22865 | redhat_vex | crypto/x509: ParsePKCS1PrivateKey panic with partial keys in crypto/x509 | fixed: 25 known affected: 4 known not affected: 328 | 2026-10-08T11:07:48+00:00 | Vulnerability · Source |
| CVE-2024-29041 | redhat_vex | express: cause malformed URLs to be evaluated | fixed: 227 known affected: 59 known not affected: 600 | 2026-10-08T11:04:07+00:00 | Vulnerability · Source |
| CVE-2025-21614 | redhat_vex | go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies | fixed: 527 known affected: 18 known not affected: 968 under investigation: 221 | 2026-10-08T11:03:30+00:00 | Vulnerability · Source |
| CVE-2025-21613 | redhat_vex | go-git: argument injection via the URL field | fixed: 553 known affected: 16 known not affected: 1075 | 2026-10-08T11:03:11+00:00 | Vulnerability · Source |
| CVE-2024-38816 | redhat_vex | spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource | fixed: 2 known affected: 8 known not affected: 8 | 2026-10-08T10:55:14+00:00 | Vulnerability · Source |
| CVE-2024-7885 | redhat_vex | undertow: Improper State Management in Proxy Protocol parsing causes information leakage | fixed: 146 known affected: 9 known not affected: 2198 | 2026-10-08T10:55:07+00:00 | Vulnerability · Source |
| CVE-2023-33953 | redhat_vex | gRPC: hpack table accounting errors can lead to denial of service | fixed: 9 known not affected: 479 | 2026-10-08T10:54:25+00:00 | Vulnerability · Source |
| CVE-2024-21626 | redhat_vex | runc: file descriptor leak | fixed: 2007 known affected: 38 known not affected: 2786 | 2026-10-08T10:53:41+00:00 | Vulnerability · Source |
| CVE-2024-47072 | redhat_vex | com.thoughtworks.xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream | fixed: 35 known affected: 10 known not affected: 12 | 2026-10-08T10:53:15+00:00 | Vulnerability · Source |
| CVE-2024-29415 | redhat_vex | node-ip: Incomplete fix for CVE-2023-42282 | fixed: 3 known affected: 6 known not affected: 136 | 2026-10-08T10:48:15+00:00 | Vulnerability · Source |
| CVE-2024-47875 | redhat_vex | dompurify: nesting-based mutation XSS vulnerability | fixed: 224 known affected: 15 known not affected: 2689 | 2026-10-08T10:46:43+00:00 | Vulnerability · Source |
| CVE-2026-106550 | redhat_vex | convict: convict: Denial of Service via prototype pollution in config.set() | known affected: 1 | 2026-10-08T09:53:12+00:00 | Vulnerability · Source |