VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
293999 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-3304 | redhat_vex | multer: Multer: Denial of Service via malformed requests | fixed: 2 known affected: 1 known not affected: 34 | 2026-06-30T04:01:10+00:00 | Vulnerability · Source |
| CVE-2026-3086 | redhat_vex | GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in H.266 Codec Parser | known affected: 6 known not affected: 16 | 2026-06-30T04:00:57+00:00 | Vulnerability · Source |
| CVE-2026-3084 | redhat_vex | GStreamer: GStreamer: Remote Code Execution via integer underflow in H.266 Codec Parser | known affected: 6 known not affected: 16 | 2026-06-30T04:00:53+00:00 | Vulnerability · Source |
| CVE-2026-3081 | redhat_vex | GStreamer: GStreamer: Arbitrary code execution via H.266 codec parsing stack-based buffer overflow | known not affected: 22 | 2026-06-30T04:00:47+00:00 | Vulnerability · Source |
| CVE-2026-3047 | redhat_vex | org.keycloak.broker.saml: Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login | fixed: 20 | 2026-06-30T04:00:42+00:00 | Vulnerability · Source |
| CVE-2026-3029 | redhat_vex | PyMuPDF: PyMuPDF: Arbitrary file write via path traversal vulnerability | known affected: 3 | 2026-06-30T04:00:35+00:00 | Vulnerability · Source |
| CVE-2026-3006 | redhat_vex | winfsp: winfsp: Local privilege escalation via race condition and kernel heap overflow | known not affected: 1 | 2026-06-30T04:00:20+00:00 | Vulnerability · Source |
| CVE-2026-2818 | redhat_vex | org.springframework.data/spring-data-geode: Spring Data Geode: Path traversal vulnerability allows arbitrary file write via import snapshot functionality. | known not affected: 1 | 2026-06-30T04:00:09+00:00 | Vulnerability · Source |
| CVE-2026-2798 | redhat_vex | firefox: thunderbird: Use-after-free in the DOM: Core & HTML component | known not affected: 18 | 2026-06-30T04:00:03+00:00 | Vulnerability · Source |
| CVE-2026-2796 | redhat_vex | firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component | known not affected: 23 | 2026-06-30T04:00:02+00:00 | Vulnerability · Source |
| CVE-2026-2795 | redhat_vex | firefox: Use-after-free in the JavaScript: GC component | known not affected: 12 | 2026-06-30T04:00:01+00:00 | Vulnerability · Source |
| CVE-2026-2794 | redhat_vex | firefox: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android | known not affected: 12 | 2026-06-30T03:59:58+00:00 | Vulnerability · Source |
| CVE-2026-2792 | redhat_vex | firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | fixed: 320 known affected: 6 | 2026-06-30T03:59:55+00:00 | Vulnerability · Source |
| CVE-2026-2778 | redhat_vex | firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component | fixed: 320 known affected: 6 | 2026-06-30T03:59:53+00:00 | Vulnerability · Source |
| CVE-2026-2776 | redhat_vex | firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software | fixed: 320 known affected: 6 | 2026-06-30T03:59:50+00:00 | Vulnerability · Source |
| CVE-2026-2775 | redhat_vex | firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component | fixed: 320 known affected: 8 | 2026-06-30T03:59:47+00:00 | Vulnerability · Source |
| CVE-2026-2772 | redhat_vex | firefox: thunderbird: Use-after-free in the Audio/Video: Playback component | fixed: 320 known affected: 8 | 2026-06-30T03:59:41+00:00 | Vulnerability · Source |
| CVE-2026-2769 | redhat_vex | firefox: thunderbird: Use-after-free in the Storage: IndexedDB component | fixed: 320 known affected: 8 | 2026-06-30T03:59:38+00:00 | Vulnerability · Source |
| CVE-2026-2768 | redhat_vex | firefox: thunderbird: Sandbox escape in the Storage: IndexedDB component | fixed: 320 known affected: 6 | 2026-06-30T03:59:35+00:00 | Vulnerability · Source |
| CVE-2026-2767 | redhat_vex | firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component | fixed: 320 known affected: 6 | 2026-06-30T03:59:34+00:00 | Vulnerability · Source |
| CVE-2026-2757 | redhat_vex | firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component | fixed: 320 known affected: 6 | 2026-06-30T03:59:22+00:00 | Vulnerability · Source |
| CVE-2026-2603 | redhat_vex | keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider | fixed: 20 | 2026-06-30T03:59:17+00:00 | Vulnerability · Source |
| CVE-2026-44016 | redhat_vex | docling: Docling: Remote code execution via malicious HTML in Playwright-based rendering | known not affected: 1 | 2026-06-30T03:59:11+00:00 | Vulnerability · Source |
| CVE-2026-43824 | redhat_vex | github.com/argoproj/argo-cd/: Argo CD: Information disclosure via ServerSideDiff allows reading Kubernetes Secret data | known affected: 1 known not affected: 10 | 2026-06-30T03:58:45+00:00 | Vulnerability · Source |
| CVE-2026-43494 | redhat_vex | kernel: net/rds: reset op_nents when zerocopy page pin fails | known not affected: 274 | 2026-06-30T03:58:33+00:00 | Vulnerability · Source |
| CVE-2026-43178 | redhat_vex | kernel: procfs: fix possible double mmput() in do_procmap_query() | known not affected: 260 under investigation: 14 | 2026-06-30T03:58:28+00:00 | Vulnerability · Source |
| CVE-2026-42899 | redhat_vex | dotnet: .NET: infinite loop allows an attacker to cause a denial of service | fixed: 1437 known not affected: 6 | 2026-06-30T03:57:55+00:00 | Vulnerability · Source |
| CVE-2026-42573 | redhat_vex | svelte: Svelte: Cross-Site Scripting via DOM Clobbering | known not affected: 1 | 2026-06-30T03:57:44+00:00 | Vulnerability · Source |
| CVE-2026-42296 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Privilege escalation via security control bypass | known affected: 7 | 2026-06-30T03:57:30+00:00 | Vulnerability · Source |
| CVE-2026-42294 | redhat_vex | Argo Workflows: github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via large request body to Webhook Interceptor | known affected: 2 | 2026-06-30T03:57:26+00:00 | Vulnerability · Source |
| CVE-2026-42271 | redhat_vex | litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints | fixed: 8 known not affected: 19 | 2026-06-30T03:57:25+00:00 | Vulnerability · Source |
| CVE-2026-42203 | redhat_vex | litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates | known affected: 1 known not affected: 2 | 2026-06-30T03:57:10+00:00 | Vulnerability · Source |
| CVE-2026-41651 | redhat_vex | PackageKit: race condition vulnerability leads to arbitrary package installation as root | fixed: 941 known not affected: 17 | 2026-06-30T03:56:23+00:00 | Vulnerability · Source |
| CVE-2026-41481 | redhat_vex | langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass | known affected: 7 | 2026-06-30T03:56:15+00:00 | Vulnerability · Source |
| CVE-2026-41246 | redhat_vex | Contour: Envoy: github.com/projectcontour/contour: Contour: Arbitrary Code Execution and Denial of Service via Lua Code Injection | known not affected: 2 | 2026-06-30T03:56:03+00:00 | Vulnerability · Source |
| CVE-2026-41179 | redhat_vex | github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint | known not affected: 4 | 2026-06-30T03:55:58+00:00 | Vulnerability · Source |
| CVE-2026-41176 | redhat_vex | github.com/rclone/rclone: Rclone: Unauthorized access to administrative functions through unauthenticated Remote Control endpoint. | known not affected: 4 | 2026-06-30T03:55:54+00:00 | Vulnerability · Source |
| CVE-2026-41139 | redhat_vex | mathjs: math.js: Arbitrary code execution via expression parser | known not affected: 41 | 2026-06-30T03:55:51+00:00 | Vulnerability · Source |
| CVE-2026-41140 | redhat_vex | poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction | fixed: 8 known affected: 2 known not affected: 112 | 2026-06-30T03:55:49+00:00 | Vulnerability · Source |
| CVE-2026-40982 | redhat_vex | Spring Cloud Config: spring-cloud-config-server: Spring Cloud Config: Directory traversal allows arbitrary file access | known not affected: 5 | 2026-06-30T03:55:30+00:00 | Vulnerability · Source |
| CVE-2026-40981 | redhat_vex | Spring Cloud Config: Spring Cloud Config: Information disclosure of secrets from unintended GCP projects | known not affected: 5 | 2026-06-30T03:55:25+00:00 | Vulnerability · Source |
| CVE-2026-40976 | redhat_vex | Spring Boot: Spring Boot: Security bypass due to ineffective default web security | known affected: 1 known not affected: 28 | 2026-06-30T03:55:24+00:00 | Vulnerability · Source |
| CVE-2026-40975 | redhat_vex | Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. | fixed: 11 known affected: 3 known not affected: 66 | 2026-06-30T03:55:20+00:00 | Vulnerability · Source |
| CVE-2026-40912 | redhat_vex | github.com/traefik/traefik: Traefik: Authentication bypass via crafted URL dot-segments in StripPrefixRegex middleware | fixed: 4 known not affected: 57 | 2026-06-30T03:55:14+00:00 | Vulnerability · Source |
| CVE-2026-40906 | redhat_vex | electric-sql: ElectricSQL: Critical data compromise and loss via SQL injection | known not affected: 1 | 2026-06-30T03:55:09+00:00 | Vulnerability · Source |
| CVE-2026-40897 | redhat_vex | mathjs: Math.js: Arbitrary code execution via expression parser | known not affected: 40 | 2026-06-30T03:55:06+00:00 | Vulnerability · Source |
| CVE-2026-40886 | redhat_vex | github.com/argoproj/argo-workflows: Argo Workflows: Denial of Service via malformed workflow pod annotation | known not affected: 14 | 2026-06-30T03:55:00+00:00 | Vulnerability · Source |
| CVE-2026-40611 | redhat_vex | github.com/go-acme/lego: Lego: Arbitrary file write and deletion via path traversal from a malicious ACME server | fixed: 4 known not affected: 57 | 2026-06-30T03:54:58+00:00 | Vulnerability · Source |
| CVE-2026-40575 | redhat_vex | oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header | known affected: 1 | 2026-06-30T03:54:55+00:00 | Vulnerability · Source |
| CVE-2026-40261 | redhat_vex | composer: command injection via malicious Perforce source reference/url | fixed: 2 | 2026-06-30T03:54:41+00:00 | Vulnerability · Source |