VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297761 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-7149 | redhat_vex | dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal | known not affected: 1 | 2026-06-05T19:40:00+00:00 | Vulnerability · Source |
| CVE-2026-7824 | redhat_vex | PaperCut Hive (Ricoh): Plain text password in logs | known not affected: 1 | 2026-06-05T19:40:00+00:00 | Vulnerability · Source |
| CVE-2026-7563 | redhat_vex | Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions | known not affected: 1 | 2026-06-05T19:40:00+00:00 | Vulnerability · Source |
| CVE-2026-7446 | redhat_vex | VetCoders mcp-server-semgrep MCP index.ts create_rule os command injection | known not affected: 1 | 2026-06-05T19:40:00+00:00 | Vulnerability · Source |
| CVE-2026-7626 | redhat_vex | Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields | known not affected: 1 | 2026-06-05T19:40:00+00:00 | Vulnerability · Source |
| CVE-2026-7536 | redhat_vex | Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of service | known not affected: 1 | 2026-06-05T19:39:59+00:00 | Vulnerability · Source |
| CVE-2026-7572 | redhat_vex | Velociraptor EVTX Parser — Process Crash via Crafted .evtx File | known not affected: 1 | 2026-06-05T19:39:59+00:00 | Vulnerability · Source |
| CVE-2026-7059 | redhat_vex | 666ghj MiroFish Query Parameter simulation.py get_simulation_posts path traversal | known not affected: 1 | 2026-06-05T19:39:59+00:00 | Vulnerability · Source |
| CVE-2026-7257 | redhat_vex | CVE-2026-7257 | known not affected: 1 | 2026-06-05T19:39:58+00:00 | Vulnerability · Source |
| CVE-2026-7590 | redhat_vex | eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection | known not affected: 1 | 2026-06-05T19:39:57+00:00 | Vulnerability · Source |
| CVE-2026-7437 | redhat_vex | AzonPost <= 1.3 - Reflected Cross-Site Scripting | known not affected: 1 | 2026-06-05T19:39:57+00:00 | Vulnerability · Source |
| CVE-2026-7194 | redhat_vex | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection | known not affected: 1 | 2026-06-05T19:39:56+00:00 | Vulnerability · Source |
| CVE-2026-7158 | redhat_vex | dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery | known not affected: 1 | 2026-06-05T19:39:56+00:00 | Vulnerability · Source |
| CVE-2026-7060 | redhat_vex | liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection | known not affected: 1 | 2026-06-05T19:39:55+00:00 | Vulnerability · Source |
| CVE-2026-7778 | redhat_vex | runZero Platform dashboard configuration exposure | known not affected: 1 | 2026-06-05T19:39:54+00:00 | Vulnerability · Source |
| CVE-2026-7132 | redhat_vex | code-projects Online Lot Reservation System download.php readfile path traversal | known not affected: 1 | 2026-06-05T19:39:53+00:00 | Vulnerability · Source |
| CVE-2026-7051 | redhat_vex | Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter | known not affected: 1 | 2026-06-05T19:39:53+00:00 | Vulnerability · Source |
| CVE-2026-7109 | redhat_vex | code-projects Invoice System in Laravel API Endpoint item improper authorization | known not affected: 1 | 2026-06-05T19:39:52+00:00 | Vulnerability · Source |
| CVE-2026-7226 | redhat_vex | SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection | known not affected: 1 | 2026-06-05T19:39:51+00:00 | Vulnerability · Source |
| CVE-2026-7064 | redhat_vex | AgentDeskAI browser-tools-mcp browser-connector.ts os command injection | known not affected: 1 | 2026-06-05T19:39:50+00:00 | Vulnerability · Source |
| CVE-2026-7541 | redhat_vex | Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint | known not affected: 1 | 2026-06-05T19:39:49+00:00 | Vulnerability · Source |
| CVE-2026-7046 | redhat_vex | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter | known not affected: 1 | 2026-06-05T19:39:49+00:00 | Vulnerability · Source |
| CVE-2026-7396 | redhat_vex | NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal | known not affected: 1 | 2026-06-05T19:39:48+00:00 | Vulnerability · Source |
| CVE-2026-7811 | redhat_vex | 54yyyu code-mcp MCP File server.py is_safe_path path traversal | known not affected: 1 | 2026-06-05T19:39:48+00:00 | Vulnerability · Source |
| CVE-2026-7217 | redhat_vex | Deepractice PromptX Document File index.ts read_pdf absolute path traversal | known not affected: 1 | 2026-06-05T19:39:48+00:00 | Vulnerability · Source |
| CVE-2026-7235 | redhat_vex | ErlichLiu claude-agent-sdk-master route.ts path traversal | known not affected: 1 | 2026-06-05T19:39:47+00:00 | Vulnerability · Source |
| CVE-2026-7073 | redhat_vex | itsourcecode Construction Management System execute.php sql injection | known not affected: 1 | 2026-06-05T19:39:47+00:00 | Vulnerability · Source |
| CVE-2026-7550 | redhat_vex | SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injection | known not affected: 1 | 2026-06-05T19:39:45+00:00 | Vulnerability · Source |
| CVE-2026-7648 | redhat_vex | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter | known not affected: 1 | 2026-06-05T19:39:45+00:00 | Vulnerability · Source |
| CVE-2026-7468 | redhat_vex | 1024-lab smart-admin Demo Site index.html access control | known not affected: 1 | 2026-06-05T19:39:44+00:00 | Vulnerability · Source |
| CVE-2026-7723 | redhat_vex | PrefectHQ prefect WebSocket Endpoint in missing authentication | known not affected: 1 | 2026-06-05T19:39:43+00:00 | Vulnerability · Source |
| CVE-2026-7561 | redhat_vex | Tm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting | known not affected: 1 | 2026-06-05T19:39:43+00:00 | Vulnerability · Source |
| CVE-2026-7048 | redhat_vex | Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:39:41+00:00 | Vulnerability · Source |
| CVE-2026-7462 | redhat_vex | VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter | known not affected: 1 | 2026-06-05T19:39:41+00:00 | Vulnerability · Source |
| CVE-2026-7525 | redhat_vex | My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter | known not affected: 1 | 2026-06-05T19:39:41+00:00 | Vulnerability · Source |
| CVE-2026-7228 | redhat_vex | SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection | known not affected: 1 | 2026-06-05T19:39:41+00:00 | Vulnerability · Source |
| CVE-2026-7552 | redhat_vex | Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter | known not affected: 1 | 2026-06-05T19:39:41+00:00 | Vulnerability · Source |
| CVE-2026-7066 | redhat_vex | choieastsea simple-openstack-mcp server.py exec_openstack os command injection | known not affected: 1 | 2026-06-05T19:39:40+00:00 | Vulnerability · Source |
| CVE-2026-7426 | redhat_vex | Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP | known not affected: 1 | 2026-06-05T19:39:40+00:00 | Vulnerability · Source |
| CVE-2026-7147 | redhat_vex | JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery | known not affected: 1 | 2026-06-05T19:39:40+00:00 | Vulnerability · Source |
| CVE-2026-7183 | redhat_vex | aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception | known not affected: 1 | 2026-06-05T19:39:39+00:00 | Vulnerability · Source |
| CVE-2026-7660 | redhat_vex | Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter | known not affected: 1 | 2026-06-05T19:39:39+00:00 | Vulnerability · Source |
| CVE-2026-7075 | redhat_vex | itsourcecode Construction Management System locations.php sql injection | known not affected: 1 | 2026-06-05T19:39:38+00:00 | Vulnerability · Source |
| CVE-2026-7714 | redhat_vex | crocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication | known not affected: 1 | 2026-06-05T19:39:38+00:00 | Vulnerability · Source |
| CVE-2026-7237 | redhat_vex | AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal | known not affected: 1 | 2026-06-05T19:39:37+00:00 | Vulnerability · Source |
| CVE-2026-7255 | redhat_vex | CVE-2026-7255 | known not affected: 1 | 2026-06-05T19:39:37+00:00 | Vulnerability · Source |
| CVE-2026-7417 | redhat_vex | Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery | known not affected: 1 | 2026-06-05T19:39:35+00:00 | Vulnerability · Source |
| CVE-2026-7651 | redhat_vex | User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter | known not affected: 1 | 2026-06-05T19:39:35+00:00 | Vulnerability · Source |
| CVE-2026-7400 | redhat_vex | geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal | known not affected: 1 | 2026-06-05T19:39:34+00:00 | Vulnerability · Source |
| CVE-2026-7206 | redhat_vex | dubydu sqlite-mcp entry.py extract_to_json sql injection | known not affected: 1 | 2026-06-05T19:39:34+00:00 | Vulnerability · Source |