VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297763 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-3318 | redhat_vex | Multiple vulnerabilities in Cradle e-commerce | known not affected: 1 | 2026-06-05T19:37:42+00:00 | Vulnerability · Source |
| CVE-2026-3299 | redhat_vex | WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode | known not affected: 1 | 2026-06-05T19:37:40+00:00 | Vulnerability · Source |
| CVE-2026-3659 | redhat_vex | WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:37:40+00:00 | Vulnerability · Source |
| CVE-2026-3569 | redhat_vex | Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint | known not affected: 1 | 2026-06-05T19:37:39+00:00 | Vulnerability · Source |
| CVE-2026-3001 | redhat_vex | Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter | known not affected: 1 | 2026-06-05T19:37:38+00:00 | Vulnerability · Source |
| CVE-2026-3488 | redhat_vex | WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation | known not affected: 1 | 2026-06-05T19:37:38+00:00 | Vulnerability · Source |
| CVE-2026-3773 | redhat_vex | Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter | known not affected: 1 | 2026-06-05T19:37:37+00:00 | Vulnerability · Source |
| CVE-2026-3513 | redhat_vex | TableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:37:37+00:00 | Vulnerability · Source |
| CVE-2026-3355 | redhat_vex | Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch' | known not affected: 1 | 2026-06-05T19:37:36+00:00 | Vulnerability · Source |
| CVE-2026-3117 | redhat_vex | Instance and webhook GitLab plugin commands were able to be run by non-admin users | known not affected: 1 | 2026-06-05T19:37:36+00:00 | Vulnerability · Source |
| CVE-2026-3319 | redhat_vex | Multiple vulnerabilities in Cradle e-commerce | known not affected: 1 | 2026-06-05T19:37:35+00:00 | Vulnerability · Source |
| CVE-2026-3454 | redhat_vex | GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements | known not affected: 1 | 2026-06-05T19:37:35+00:00 | Vulnerability · Source |
| CVE-2026-3508 | redhat_vex | CVE-2026-3508 | known not affected: 1 | 2026-06-05T19:37:34+00:00 | Vulnerability · Source |
| CVE-2026-3346 | redhat_vex | Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw | known not affected: 1 | 2026-06-05T19:37:33+00:00 | Vulnerability · Source |
| CVE-2026-3481 | redhat_vex | WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter | known not affected: 1 | 2026-06-05T19:37:33+00:00 | Vulnerability · Source |
| CVE-2026-3607 | redhat_vex | Access Control Check Implemented After Asset is Accessed in GitLab | known not affected: 1 | 2026-06-05T19:37:31+00:00 | Vulnerability · Source |
| CVE-2026-3867 | redhat_vex | CVE-2026-3867 | known not affected: 1 | 2026-06-05T19:37:30+00:00 | Vulnerability · Source |
| CVE-2026-3311 | redhat_vex | The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar | known not affected: 1 | 2026-06-05T19:37:30+00:00 | Vulnerability · Source |
| CVE-2026-3885 | redhat_vex | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode | known not affected: 1 | 2026-06-05T19:37:30+00:00 | Vulnerability · Source |
| CVE-2026-3140 | redhat_vex | Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation | known not affected: 1 | 2026-06-05T19:37:29+00:00 | Vulnerability · Source |
| CVE-2026-3005 | redhat_vex | List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode | known not affected: 1 | 2026-06-05T19:37:29+00:00 | Vulnerability · Source |
| CVE-2026-3870 | redhat_vex | CVE-2026-3870 | known not affected: 1 | 2026-06-05T19:37:28+00:00 | Vulnerability · Source |
| CVE-2026-3320 | redhat_vex | Multiple vulnerabilities in Cradle e-commerce | known not affected: 1 | 2026-06-05T19:37:27+00:00 | Vulnerability · Source |
| CVE-2026-3636 | redhat_vex | Sanitize team member data returned by API | known not affected: 1 | 2026-06-05T19:37:27+00:00 | Vulnerability · Source |
| CVE-2026-3438 | redhat_vex | Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages | known not affected: 1 | 2026-06-05T19:37:25+00:00 | Vulnerability · Source |
| CVE-2026-3960 | redhat_vex | Remote Code Execution in h2oai/h2o-3 | known not affected: 1 | 2026-06-05T19:37:24+00:00 | Vulnerability · Source |
| CVE-2026-3878 | redhat_vex | WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]' | known not affected: 1 | 2026-06-05T19:37:23+00:00 | Vulnerability · Source |
| CVE-2026-3348 | redhat_vex | MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings | known not affected: 1 | 2026-06-05T19:37:23+00:00 | Vulnerability · Source |
| CVE-2026-3160 | redhat_vex | Unintended Proxy or Intermediary ('Confused Deputy') in GitLab | known not affected: 1 | 2026-06-05T19:37:23+00:00 | Vulnerability · Source |
| CVE-2026-3142 | redhat_vex | Pinterest Site Verification plugin using Meta Tag <= 1.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_var' | known not affected: 1 | 2026-06-05T19:37:22+00:00 | Vulnerability · Source |
| CVE-2026-3340 | redhat_vex | Server-Side Request Forgery (SSRF) in Langflow URL Component | known not affected: 1 | 2026-06-05T19:37:22+00:00 | Vulnerability · Source |
| CVE-2026-3995 | redhat_vex | OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting | known not affected: 1 | 2026-06-05T19:37:22+00:00 | Vulnerability · Source |
| CVE-2026-3896 | redhat_vex | Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting | known not affected: 1 | 2026-06-05T19:37:21+00:00 | Vulnerability · Source |
| CVE-2026-3173 | redhat_vex | Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure | known not affected: 1 | 2026-06-05T19:37:21+00:00 | Vulnerability · Source |
| CVE-2026-3074 | redhat_vex | Authorization Bypass Through User-Controlled Key in GitLab | known not affected: 1 | 2026-06-05T19:37:20+00:00 | Vulnerability · Source |
| CVE-2026-3362 | redhat_vex | Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting | known not affected: 1 | 2026-06-05T19:37:20+00:00 | Vulnerability · Source |
| CVE-2026-3317 | redhat_vex | Reflected Cross-Site Scripting in Navigate CMS application | known not affected: 1 | 2026-06-05T19:37:20+00:00 | Vulnerability · Source |
| CVE-2026-3551 | redhat_vex | Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting | known not affected: 1 | 2026-06-05T19:37:20+00:00 | Vulnerability · Source |
| CVE-2026-3722 | redhat_vex | Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute | known not affected: 1 | 2026-06-05T19:37:19+00:00 | Vulnerability · Source |
| CVE-2026-3829 | redhat_vex | WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering | known not affected: 1 | 2026-06-05T19:37:19+00:00 | Vulnerability · Source |
| CVE-2026-3676 | redhat_vex | There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products. | known not affected: 1 | 2026-06-05T19:37:19+00:00 | Vulnerability · Source |
| CVE-2026-3568 | redhat_vex | MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update | known not affected: 1 | 2026-06-05T19:37:19+00:00 | Vulnerability · Source |
| CVE-2026-3649 | redhat_vex | Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action | known not affected: 1 | 2026-06-05T19:37:19+00:00 | Vulnerability · Source |
| CVE-2026-47334 | redhat_vex | Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling | known not affected: 1 | 2026-06-05T19:37:18+00:00 | Vulnerability · Source |
| CVE-2026-3694 | redhat_vex | Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode | known not affected: 1 | 2026-06-05T19:37:18+00:00 | Vulnerability · Source |
| CVE-2026-3595 | redhat_vex | Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter | known not affected: 1 | 2026-06-05T19:37:18+00:00 | Vulnerability · Source |
| CVE-2026-30895 | redhat_vex | Joomla! Core - [20260504] - XSS in readmore links | known not affected: 1 | 2026-06-05T19:37:18+00:00 | Vulnerability · Source |
| CVE-2026-47091 | redhat_vex | Claude HUD 0.0.12 Path Traversal via transcript_path | known not affected: 1 | 2026-06-05T19:37:17+00:00 | Vulnerability · Source |
| CVE-2026-47136 | redhat_vex | RustFS: Unauthenticated RustFS console license endpoint exposes license metadata | known not affected: 1 | 2026-06-05T19:37:17+00:00 | Vulnerability · Source |
| CVE-2026-47675 | redhat_vex | Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection | known not affected: 1 | 2026-06-05T19:37:17+00:00 | Vulnerability · Source |