VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297761 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2022-31114 | redhat_vex | backpack/crud Vulnerable to Cross-site Scripting | known not affected: 1 | 2026-06-05T19:40:22+00:00 | Vulnerability · Source |
| CVE-2026-25600 | redhat_vex | Credential Exposure Vulnerability in Trac PDBM | known not affected: 1 | 2026-06-05T19:40:21+00:00 | Vulnerability · Source |
| CVE-2026-25901 | redhat_vex | Joomla! Core - [20260502] - XSS in com_associations | known not affected: 1 | 2026-06-05T19:40:21+00:00 | Vulnerability · Source |
| CVE-2026-25468 | redhat_vex | WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability | known not affected: 1 | 2026-06-05T19:40:21+00:00 | Vulnerability · Source |
| CVE-2026-25426 | redhat_vex | WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:40:20+00:00 | Vulnerability · Source |
| CVE-2026-25431 | redhat_vex | WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:40:20+00:00 | Vulnerability · Source |
| CVE-2026-25444 | redhat_vex | WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:40:20+00:00 | Vulnerability · Source |
| CVE-2026-25602 | redhat_vex | CVE-2026-25602 | known not affected: 1 | 2026-06-05T19:40:20+00:00 | Vulnerability · Source |
| CVE-2026-25125 | redhat_vex | October CMS: Environment Variable Exfiltration via INI Parser Interpolation | known not affected: 1 | 2026-06-05T19:40:19+00:00 | Vulnerability · Source |
| CVE-2026-25107 | redhat_vex | CVE-2026-25107 | known not affected: 1 | 2026-06-05T19:40:18+00:00 | Vulnerability · Source |
| CVE-2026-25088 | redhat_vex | CVE-2026-25088 | known not affected: 1 | 2026-06-05T19:40:18+00:00 | Vulnerability · Source |
| CVE-2026-25206 | redhat_vex | CVE-2026-25206 | known not affected: 1 | 2026-06-05T19:40:18+00:00 | Vulnerability · Source |
| CVE-2026-25691 | redhat_vex | CVE-2026-25691 | known not affected: 1 | 2026-06-05T19:40:17+00:00 | Vulnerability · Source |
| CVE-2026-43572 | redhat_vex | OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler | known not affected: 1 | 2026-06-05T19:40:17+00:00 | Vulnerability · Source |
| CVE-2026-25607 | redhat_vex | Weak password encoding in STER | known not affected: 1 | 2026-06-05T19:40:17+00:00 | Vulnerability · Source |
| CVE-2026-25436 | redhat_vex | WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:40:16+00:00 | Vulnerability · Source |
| CVE-2026-25850 | redhat_vex | filemanagement_storage_service has an improper preservation of permissions vulnerability | known not affected: 1 | 2026-06-05T19:40:16+00:00 | Vulnerability · Source |
| CVE-2026-25599 | redhat_vex | Missing authentication and clear‑text data transmission affecting Orca heat pumps | known not affected: 1 | 2026-06-05T19:40:15+00:00 | Vulnerability · Source |
| CVE-2026-25720 | redhat_vex | SenseLive X3050 Insufficient session expiration | known not affected: 1 | 2026-06-05T19:40:15+00:00 | Vulnerability · Source |
| CVE-2026-25900 | redhat_vex | Joomla! Core - [20260501] - XSS in feed modules | known not affected: 1 | 2026-06-05T19:40:14+00:00 | Vulnerability · Source |
| CVE-2026-25209 | redhat_vex | CVE-2026-25209 | known not affected: 1 | 2026-06-05T19:40:14+00:00 | Vulnerability · Source |
| CVE-2026-25883 | redhat_vex | Vexa Webhook Feature has a SSRF Vulnerability | known not affected: 1 | 2026-06-05T19:40:13+00:00 | Vulnerability · Source |
| CVE-2026-25852 | redhat_vex | CVE-2026-25852 | known not affected: 1 | 2026-06-05T19:40:12+00:00 | Vulnerability · Source |
| CVE-2026-43644 | redhat_vex | podinfo 6.11.2 Reflected XSS via /echo Endpoint | known not affected: 1 | 2026-06-05T19:40:12+00:00 | Vulnerability · Source |
| CVE-2026-25690 | redhat_vex | CVE-2026-25690 | known not affected: 1 | 2026-06-05T19:40:12+00:00 | Vulnerability · Source |
| CVE-2026-43580 | redhat_vex | OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions | known not affected: 1 | 2026-06-05T19:40:11+00:00 | Vulnerability · Source |
| CVE-2026-43532 | redhat_vex | OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image | known not affected: 1 | 2026-06-05T19:40:11+00:00 | Vulnerability · Source |
| CVE-2026-43877 | redhat_vex | WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes | known not affected: 1 | 2026-06-05T19:40:11+00:00 | Vulnerability · Source |
| CVE-2026-43875 | redhat_vex | WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover | known not affected: 1 | 2026-06-05T19:40:11+00:00 | Vulnerability · Source |
| CVE-2026-43936 | redhat_vex | e107: Server-Side Request Forgery (SSRF) in the remote file fetcher | known not affected: 1 | 2026-06-05T19:40:10+00:00 | Vulnerability · Source |
| CVE-2026-43576 | redhat_vex | OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL | known not affected: 1 | 2026-06-05T19:40:10+00:00 | Vulnerability · Source |
| CVE-2026-43965 | redhat_vex | Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion | known not affected: 1 | 2026-06-05T19:40:09+00:00 | Vulnerability · Source |
| CVE-2026-43880 | redhat_vex | WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address | known not affected: 1 | 2026-06-05T19:40:08+00:00 | Vulnerability · Source |
| CVE-2026-43574 | redhat_vex | OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists | known not affected: 1 | 2026-06-05T19:40:08+00:00 | Vulnerability · Source |
| CVE-2026-43934 | redhat_vex | e107: Broken Access Control in e107 comment edit allows cross-user comment modification | known not affected: 1 | 2026-06-05T19:40:07+00:00 | Vulnerability · Source |
| CVE-2026-43616 | redhat_vex | Detect-It-Easy < 3.21 Path Traversal Arbitrary File Write | known not affected: 1 | 2026-06-05T19:40:06+00:00 | Vulnerability · Source |
| CVE-2026-43979 | redhat_vex | Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`) | known not affected: 1 | 2026-06-05T19:40:05+00:00 | Vulnerability · Source |
| CVE-2026-43917 | redhat_vex | Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation | known not affected: 1 | 2026-06-05T19:40:04+00:00 | Vulnerability · Source |
| CVE-2026-43889 | redhat_vex | Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share | known not affected: 1 | 2026-06-05T19:40:04+00:00 | Vulnerability · Source |
| CVE-2026-43881 | redhat_vex | WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard | known not affected: 1 | 2026-06-05T19:40:03+00:00 | Vulnerability · Source |
| CVE-2026-43638 | redhat_vex | Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import | known not affected: 1 | 2026-06-05T19:40:03+00:00 | Vulnerability · Source |
| CVE-2026-43926 | redhat_vex | FOSSBilling's password reset confirmation endpoint lacks rate limiting | known not affected: 1 | 2026-06-05T19:40:03+00:00 | Vulnerability · Source |
| CVE-2026-43878 | redhat_vex | WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal | known not affected: 1 | 2026-06-05T19:40:02+00:00 | Vulnerability · Source |
| CVE-2026-43883 | redhat_vex | WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements | known not affected: 1 | 2026-06-05T19:40:02+00:00 | Vulnerability · Source |
| CVE-2026-43582 | redhat_vex | OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass | known not affected: 1 | 2026-06-05T19:40:01+00:00 | Vulnerability · Source |
| CVE-2026-43995 | redhat_vex | Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) | known not affected: 1 | 2026-06-05T19:40:01+00:00 | Vulnerability · Source |
| CVE-2026-43573 | redhat_vex | OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes | known not affected: 1 | 2026-06-05T19:40:01+00:00 | Vulnerability · Source |
| CVE-2026-43942 | redhat_vex | electerm: Full process.env exposed to renderer via window.pre.env in electerm | known not affected: 1 | 2026-06-05T19:40:01+00:00 | Vulnerability · Source |
| CVE-2026-43924 | redhat_vex | FOSSBilling has an open redirect via administrator-configured redirect targets | known not affected: 1 | 2026-06-05T19:40:01+00:00 | Vulnerability · Source |
| CVE-2026-7509 | redhat_vex | KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] | known not affected: 1 | 2026-06-05T19:40:00+00:00 | Vulnerability · Source |