VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297763 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-41061 | redhat_vex | WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver | known not affected: 1 | 2026-06-05T19:36:26+00:00 | Vulnerability · Source |
| CVE-2026-41034 | redhat_vex | CVE-2026-41034 | known not affected: 1 | 2026-06-05T19:36:25+00:00 | Vulnerability · Source |
| CVE-2026-41689 | redhat_vex | Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services | known not affected: 1 | 2026-06-05T19:36:25+00:00 | Vulnerability · Source |
| CVE-2026-41232 | redhat_vex | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing | known not affected: 1 | 2026-06-05T19:36:25+00:00 | Vulnerability · Source |
| CVE-2026-41317 | redhat_vex | Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation | known not affected: 1 | 2026-06-05T19:36:24+00:00 | Vulnerability · Source |
| CVE-2026-41968 | redhat_vex | CVE-2026-41968 | known not affected: 1 | 2026-06-05T19:36:24+00:00 | Vulnerability · Source |
| CVE-2026-41887 | redhat_vex | Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) | known not affected: 1 | 2026-06-05T19:36:24+00:00 | Vulnerability · Source |
| CVE-2026-41128 | redhat_vex | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | known not affected: 1 | 2026-06-05T19:36:23+00:00 | Vulnerability · Source |
| CVE-2026-41281 | redhat_vex | CVE-2026-41281 | known not affected: 1 | 2026-06-05T19:36:23+00:00 | Vulnerability · Source |
| CVE-2026-41412 | redhat_vex | alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script | known not affected: 1 | 2026-06-05T19:36:23+00:00 | Vulnerability · Source |
| CVE-2026-41182 | redhat_vex | LangSmith SDK: Streaming token events bypass output redaction | known not affected: 1 | 2026-06-05T19:36:21+00:00 | Vulnerability · Source |
| CVE-2026-41119 | redhat_vex | CVE-2026-41119 | known not affected: 1 | 2026-06-05T19:36:20+00:00 | Vulnerability · Source |
| CVE-2026-41344 | redhat_vex | OpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter | known not affected: 1 | 2026-06-05T19:36:20+00:00 | Vulnerability · Source |
| CVE-2026-41704 | redhat_vex | Compromised VM can make arbitrary blobstore deletes | known not affected: 1 | 2026-06-05T19:36:20+00:00 | Vulnerability · Source |
| CVE-2026-41173 | redhat_vex | Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS | known not affected: 1 | 2026-06-05T19:36:18+00:00 | Vulnerability · Source |
| CVE-2026-41298 | redhat_vex | OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint | known not affected: 1 | 2026-06-05T19:36:17+00:00 | Vulnerability · Source |
| CVE-2026-41577 | redhat_vex | authentik: SAML source does not validate Conditions, timing, or audience on assertions | known not affected: 1 | 2026-06-05T19:36:17+00:00 | Vulnerability · Source |
| CVE-2026-41658 | redhat_vex | Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items | known not affected: 1 | 2026-06-05T19:36:17+00:00 | Vulnerability · Source |
| CVE-2026-41030 | redhat_vex | CVE-2026-41030 | known not affected: 1 | 2026-06-05T19:36:16+00:00 | Vulnerability · Source |
| CVE-2026-41469 | redhat_vex | Beghelli Sicuro24 SicuroWeb Missing Content Security Policy | known not affected: 1 | 2026-06-05T19:36:15+00:00 | Vulnerability · Source |
| CVE-2026-41184 | redhat_vex | ServiceAccount token disclosure via install-cni container logs | known not affected: 1 | 2026-06-05T19:36:14+00:00 | Vulnerability · Source |
| CVE-2026-41388 | redhat_vex | OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling | known not affected: 1 | 2026-06-05T19:36:14+00:00 | Vulnerability · Source |
| CVE-2026-41487 | redhat_vex | Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys | known not affected: 1 | 2026-06-05T19:36:13+00:00 | Vulnerability · Source |
| CVE-2026-41346 | redhat_vex | OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement | known not affected: 1 | 2026-06-05T19:36:12+00:00 | Vulnerability · Source |
| CVE-2026-41661 | redhat_vex | Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion | known not affected: 1 | 2026-06-05T19:36:12+00:00 | Vulnerability · Source |
| CVE-2026-41067 | redhat_vex | Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass | known not affected: 1 | 2026-06-05T19:36:10+00:00 | Vulnerability · Source |
| CVE-2026-41337 | redhat_vex | OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay | known not affected: 1 | 2026-06-05T19:36:09+00:00 | Vulnerability · Source |
| CVE-2026-41373 | redhat_vex | OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy | known not affected: 1 | 2026-06-05T19:36:08+00:00 | Vulnerability · Source |
| CVE-2026-41418 | redhat_vex | 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint | known not affected: 1 | 2026-06-05T19:36:08+00:00 | Vulnerability · Source |
| CVE-2026-41966 | redhat_vex | CVE-2026-41966 | known not affected: 1 | 2026-06-05T19:36:07+00:00 | Vulnerability · Source |
| CVE-2026-41320 | redhat_vex | Frappe HR has possibility of SQL Injection due to improper field sanitization | known not affected: 1 | 2026-06-05T19:36:07+00:00 | Vulnerability · Source |
| CVE-2026-41913 | redhat_vex | OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts | known not affected: 1 | 2026-06-05T19:36:07+00:00 | Vulnerability · Source |
| CVE-2026-41885 | redhat_vex | Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend | known not affected: 1 | 2026-06-05T19:36:06+00:00 | Vulnerability · Source |
| CVE-2026-41687 | redhat_vex | Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks | known not affected: 1 | 2026-06-05T19:36:06+00:00 | Vulnerability · Source |
| CVE-2026-41063 | redhat_vex | WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) | known not affected: 1 | 2026-06-05T19:36:06+00:00 | Vulnerability · Source |
| CVE-2026-41207 | redhat_vex | netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures | known not affected: 1 | 2026-06-05T19:36:05+00:00 | Vulnerability · Source |
| CVE-2026-41360 | redhat_vex | OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding | known not affected: 1 | 2026-06-05T19:36:04+00:00 | Vulnerability · Source |
| CVE-2026-41126 | redhat_vex | BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL" | known not affected: 1 | 2026-06-05T19:36:04+00:00 | Vulnerability · Source |
| CVE-2026-41009 | redhat_vex | Local Blobstore may allow arbitrary reads/deletes | known not affected: 1 | 2026-06-05T19:36:04+00:00 | Vulnerability · Source |
| CVE-2026-41243 | redhat_vex | OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled | known not affected: 1 | 2026-06-05T19:36:03+00:00 | Vulnerability · Source |
| CVE-2026-41333 | redhat_vex | OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken | known not affected: 1 | 2026-06-05T19:36:02+00:00 | Vulnerability · Source |
| CVE-2026-41351 | redhat_vex | OpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encoding | known not affected: 1 | 2026-06-05T19:36:02+00:00 | Vulnerability · Source |
| CVE-2026-41513 | redhat_vex | Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints | known not affected: 1 | 2026-06-05T19:36:01+00:00 | Vulnerability · Source |
| CVE-2026-41971 | redhat_vex | CVE-2026-41971 | known not affected: 1 | 2026-06-05T19:36:01+00:00 | Vulnerability · Source |
| CVE-2026-41890 | redhat_vex | CI4MS: Arbitrary Database Table Drop via Theme deleteProcess | known not affected: 1 | 2026-06-05T19:36:00+00:00 | Vulnerability · Source |
| CVE-2026-41575 | redhat_vex | th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability | known not affected: 1 | 2026-06-05T19:36:00+00:00 | Vulnerability · Source |
| CVE-2026-41656 | redhat_vex | Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read | known not affected: 1 | 2026-06-05T19:35:59+00:00 | Vulnerability · Source |
| CVE-2026-23822 | redhat_vex | Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service | known not affected: 1 | 2026-06-05T19:35:57+00:00 | Vulnerability · Source |
| CVE-2026-41863 | redhat_vex | LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API | known not affected: 1 | 2026-06-05T19:35:57+00:00 | Vulnerability · Source |
| CVE-2026-23866 | redhat_vex | CVE-2026-23866 | known not affected: 1 | 2026-06-05T19:35:56+00:00 | Vulnerability · Source |