VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297698 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-45564 | redhat_vex | Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save) | known not affected: 1 | 2026-06-11T14:59:21+00:00 | Vulnerability · Source |
| CVE-2026-45558 | redhat_vex | Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save | known not affected: 1 | 2026-06-11T14:59:20+00:00 | Vulnerability · Source |
| CVE-2026-41003 | redhat_vex | Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting | known not affected: 1 | 2026-06-11T14:59:18+00:00 | Vulnerability · Source |
| CVE-2026-45556 | redhat_vex | Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name` | known not affected: 1 | 2026-06-11T14:59:18+00:00 | Vulnerability · Source |
| CVE-2026-45550 | redhat_vex | Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body | known not affected: 1 | 2026-06-11T14:59:16+00:00 | Vulnerability · Source |
| CVE-2026-45552 | redhat_vex | Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server | known not affected: 1 | 2026-06-11T14:59:16+00:00 | Vulnerability · Source |
| CVE-2025-10237 | redhat_vex | CVE-2025-10237 | known not affected: 1 | 2026-06-11T14:59:15+00:00 | Vulnerability · Source |
| CVE-2025-10238 | redhat_vex | CVE-2025-10238 | known not affected: 1 | 2026-06-11T14:59:15+00:00 | Vulnerability · Source |
| CVE-2026-45549 | redhat_vex | Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host | known not affected: 1 | 2026-06-11T14:59:15+00:00 | Vulnerability · Source |
| CVE-2026-41728 | redhat_vex | Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections | known not affected: 1 | 2026-06-11T14:59:14+00:00 | Vulnerability · Source |
| CVE-2026-41732 | redhat_vex | In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization | known not affected: 1 | 2026-06-11T14:59:14+00:00 | Vulnerability · Source |
| CVE-2026-40993 | redhat_vex | Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry | known not affected: 1 | 2026-06-11T14:59:13+00:00 | Vulnerability · Source |
| CVE-2026-41860 | redhat_vex | CVE-2026-41860 | known not affected: 1 | 2026-06-11T14:59:12+00:00 | Vulnerability · Source |
| CVE-2026-48735 | suse_vex | SUSE CVE CVE-2026-48735 | recommended: 3 | 2026-06-11T11:14:19+00:00 | Vulnerability · Source |
| CVE-2026-9060 | redhat_vex | Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style | known not affected: 1 | 2026-06-11T08:59:43+00:00 | Vulnerability · Source |
| CVE-2026-9067 | redhat_vex | Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload | known not affected: 1 | 2026-06-11T08:59:43+00:00 | Vulnerability · Source |
| CVE-2026-8071 | redhat_vex | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass | known not affected: 1 | 2026-06-11T08:59:42+00:00 | Vulnerability · Source |
| CVE-2026-3326 | redhat_vex | XStore < 9.7.3 - Unauthenticated SQLi | known not affected: 1 | 2026-06-11T08:59:42+00:00 | Vulnerability · Source |
| CVE-2026-29114 | redhat_vex | CVE-2026-29114 | known not affected: 1 | 2026-06-11T08:59:41+00:00 | Vulnerability · Source |
| CVE-2026-9213 | redhat_vex | Insufficient input validation in certain NETGEAR routers | known not affected: 1 | 2026-06-11T08:59:38+00:00 | Vulnerability · Source |
| CVE-2026-0420 | redhat_vex | Missing TLS certificate validation in NETGEAR's ReadyCloud client app | known not affected: 1 | 2026-06-11T08:59:37+00:00 | Vulnerability · Source |
| CVE-2026-9212 | redhat_vex | Insufficient authentication and input validation in certain NETGEAR products | known not affected: 1 | 2026-06-11T08:59:37+00:00 | Vulnerability · Source |
| CVE-2026-0416 | redhat_vex | Improper input validation in certain NETGEAR routers allows unauthorized modification of protected router functionality | known not affected: 1 | 2026-06-11T08:59:36+00:00 | Vulnerability · Source |
| CVE-2026-0414 | redhat_vex | Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR Routers | known not affected: 1 | 2026-06-11T08:59:33+00:00 | Vulnerability · Source |
| CVE-2026-0411 | redhat_vex | A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites | known not affected: 1 | 2026-06-11T08:59:31+00:00 | Vulnerability · Source |
| CVE-2026-0413 | redhat_vex | Buffer overflow vulnerability in certain NETGEAR Nighthawk routers | known not affected: 1 | 2026-06-11T08:59:31+00:00 | Vulnerability · Source |
| CVE-2025-15128 | redhat_vex | ZKTeco BioTime Endpoint safe_setting credentials storage | known not affected: 1 | 2026-06-11T08:59:30+00:00 | Vulnerability · Source |
| CVE-2026-9019 | redhat_vex | Easy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters | known not affected: 1 | 2026-06-11T08:59:29+00:00 | Vulnerability · Source |
| CVE-2026-8613 | redhat_vex | aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting | known not affected: 1 | 2026-06-11T08:59:28+00:00 | Vulnerability · Source |
| CVE-2026-8853 | redhat_vex | MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter | known not affected: 1 | 2026-06-11T08:59:28+00:00 | Vulnerability · Source |
| CVE-2026-29115 | redhat_vex | CVE-2026-29115 | known not affected: 1 | 2026-06-11T08:59:28+00:00 | Vulnerability · Source |
| CVE-2026-11815 | redhat_vex | Insecure Deserialization via MITM in Layer 7 Policy Manager | known not affected: 1 | 2026-06-11T08:59:21+00:00 | Vulnerability · Source |
| CVE-2025-8444 | redhat_vex | Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters | known not affected: 1 | 2026-06-11T08:59:20+00:00 | Vulnerability · Source |
| CVE-2025-66281 | redhat_vex | QTS, QuTS hero | known not affected: 1 | 2026-06-11T08:59:20+00:00 | Vulnerability · Source |
| CVE-2025-66280 | redhat_vex | QTS, QuTS hero | known not affected: 1 | 2026-06-11T08:59:19+00:00 | Vulnerability · Source |
| CVE-2025-6254 | redhat_vex | Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation | known not affected: 1 | 2026-06-11T08:59:13+00:00 | Vulnerability · Source |
| CVE-2026-3018 | redhat_vex | Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter | known not affected: 1 | 2026-06-11T08:59:13+00:00 | Vulnerability · Source |
| CVE-2026-29116 | redhat_vex | CVE-2026-29116 | known not affected: 1 | 2026-06-11T08:59:12+00:00 | Vulnerability · Source |
| CVE-2026-22893 | redhat_vex | QTS, QuTS hero | known not affected: 1 | 2026-06-11T08:59:04+00:00 | Vulnerability · Source |
| CVE-2026-10721 | redhat_vex | Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components | known not affected: 1 | 2026-06-11T08:59:03+00:00 | Vulnerability · Source |
| CVE-2025-66273 | redhat_vex | QTS, QuTS hero | known not affected: 1 | 2026-06-11T08:59:03+00:00 | Vulnerability · Source |
| CVE-2025-66279 | redhat_vex | QTS, QuTS hero | known not affected: 1 | 2026-06-11T08:59:03+00:00 | Vulnerability · Source |
| CVE-2026-35563 | redhat_vex | Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname | known not affected: 1 | 2026-06-11T08:59:03+00:00 | Vulnerability · Source |
| CVE-2026-46546 | redhat_vex | Frappe LMS: HTML injection in user-controlled metadata | known not affected: 1 | 2026-06-11T02:59:29+00:00 | Vulnerability · Source |
| CVE-2026-53698 | redhat_vex | CVE-2026-53698 | known not affected: 1 | 2026-06-11T02:59:29+00:00 | Vulnerability · Source |
| CVE-2026-41694 | redhat_vex | SAML Payloads Decrypted Without Valid Signature | known not affected: 1 | 2026-06-11T02:59:29+00:00 | Vulnerability · Source |
| CVE-2026-47905 | redhat_vex | CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) | known not affected: 1 | 2026-06-11T02:59:28+00:00 | Vulnerability · Source |
| CVE-2025-62850 | redhat_vex | QuTS hero | known not affected: 1 | 2026-06-11T02:59:27+00:00 | Vulnerability · Source |
| CVE-2026-9751 | redhat_vex | Sensitive data could be written to mongod.log | known not affected: 1 | 2026-06-11T02:59:26+00:00 | Vulnerability · Source |
| CVE-2026-46532 | redhat_vex | ESF-IDF: Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser | known not affected: 1 | 2026-06-11T02:59:25+00:00 | Vulnerability · Source |