VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297763 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-5488 | redhat_vex | ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token' | known not affected: 1 | 2026-06-05T19:35:32+00:00 | Vulnerability · Source |
| CVE-2026-5767 | redhat_vex | SlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:35:32+00:00 | Vulnerability · Source |
| CVE-2026-5974 | redhat_vex | FoundationAgents MetaGPT terminal.py Bash.run os command injection | known not affected: 1 | 2026-06-05T19:35:32+00:00 | Vulnerability · Source |
| CVE-2026-5383 | redhat_vex | runZero Explorer missing authorization check | known not affected: 1 | 2026-06-05T19:35:31+00:00 | Vulnerability · Source |
| CVE-2026-5824 | redhat_vex | code-projects Simple Laundry System userchecklogin.php sql injection | known not affected: 1 | 2026-06-05T19:35:31+00:00 | Vulnerability · Source |
| CVE-2026-5428 | redhat_vex | Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field | known not affected: 1 | 2026-06-05T19:35:30+00:00 | Vulnerability · Source |
| CVE-2026-5365 | redhat_vex | LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route | known not affected: 1 | 2026-06-05T19:35:30+00:00 | Vulnerability · Source |
| CVE-2026-5446 | redhat_vex | wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse | known not affected: 1 | 2026-06-05T19:35:29+00:00 | Vulnerability · Source |
| CVE-2026-5347 | redhat_vex | WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter | known not affected: 1 | 2026-06-05T19:35:29+00:00 | Vulnerability · Source |
| CVE-2026-5167 | redhat_vex | Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint | known not affected: 1 | 2026-06-05T19:35:27+00:00 | Vulnerability · Source |
| CVE-2026-5374 | redhat_vex | runZero Platform MCP information leak | known not affected: 1 | 2026-06-05T19:35:27+00:00 | Vulnerability · Source |
| CVE-2026-5293 | redhat_vex | 診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter | known not affected: 1 | 2026-06-05T19:35:27+00:00 | Vulnerability · Source |
| CVE-2026-5600 | redhat_vex | CVE-2026-5600 | known not affected: 1 | 2026-06-05T19:35:26+00:00 | Vulnerability · Source |
| CVE-2026-5590 | redhat_vex | net: ip/tcp: Null pointer dereference can be triggered by a race condition | known not affected: 1 | 2026-06-05T19:35:26+00:00 | Vulnerability · Source |
| CVE-2026-5985 | redhat_vex | code-projects Simple IT Discussion Forum crud.php sql injection | known not affected: 1 | 2026-06-05T19:35:26+00:00 | Vulnerability · Source |
| CVE-2026-5028 | redhat_vex | Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter | known not affected: 1 | 2026-06-05T19:35:25+00:00 | Vulnerability · Source |
| CVE-2026-5460 | redhat_vex | Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3 | known not affected: 1 | 2026-06-05T19:35:24+00:00 | Vulnerability · Source |
| CVE-2026-5820 | redhat_vex | Zypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block | known not affected: 1 | 2026-06-05T19:35:24+00:00 | Vulnerability · Source |
| CVE-2026-5163 | redhat_vex | Missing authorization check in AI message rewrite endpoint allows access to private thread content | known not affected: 1 | 2026-06-05T19:35:24+00:00 | Vulnerability · Source |
| CVE-2026-5361 | redhat_vex | Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter | known not affected: 1 | 2026-06-05T19:35:23+00:00 | Vulnerability · Source |
| CVE-2026-5998 | redhat_vex | zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal | known not affected: 1 | 2026-06-05T19:35:23+00:00 | Vulnerability · Source |
| CVE-2026-5693 | redhat_vex | Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation | known not affected: 1 | 2026-06-05T19:35:22+00:00 | Vulnerability · Source |
| CVE-2026-5774 | redhat_vex | Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map | known not affected: 1 | 2026-06-05T19:35:22+00:00 | Vulnerability · Source |
| CVE-2026-5378 | redhat_vex | runZero Platform user creation leak | known not affected: 1 | 2026-06-05T19:35:22+00:00 | Vulnerability · Source |
| CVE-2026-5451 | redhat_vex | Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode | known not affected: 1 | 2026-06-05T19:35:22+00:00 | Vulnerability · Source |
| CVE-2026-5486 | redhat_vex | Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter | known not affected: 1 | 2026-06-05T19:35:21+00:00 | Vulnerability · Source |
| CVE-2026-5717 | redhat_vex | VI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:35:20+00:00 | Vulnerability · Source |
| CVE-2026-5828 | redhat_vex | code-projects Simple IT Discussion Forum addcomment.php sql injection | known not affected: 1 | 2026-06-05T19:35:20+00:00 | Vulnerability · Source |
| CVE-2026-5393 | redhat_vex | OOB Read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTS | known not affected: 1 | 2026-06-05T19:35:20+00:00 | Vulnerability · Source |
| CVE-2026-5357 | redhat_vex | Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:35:19+00:00 | Vulnerability · Source |
| CVE-2026-5159 | redhat_vex | Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter | known not affected: 1 | 2026-06-05T19:35:19+00:00 | Vulnerability · Source |
| CVE-2026-5753 | redhat_vex | All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download | known not affected: 1 | 2026-06-05T19:35:18+00:00 | Vulnerability · Source |
| CVE-2026-5070 | redhat_vex | Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content | known not affected: 1 | 2026-06-05T19:35:17+00:00 | Vulnerability · Source |
| CVE-2026-5942 | redhat_vex | Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability | known not affected: 1 | 2026-06-05T19:35:17+00:00 | Vulnerability · Source |
| CVE-2026-5384 | redhat_vex | runZero Platform incorrect credential scope | known not affected: 1 | 2026-06-05T19:35:17+00:00 | Vulnerability · Source |
| CVE-2026-5511 | redhat_vex | Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72 | known not affected: 1 | 2026-06-05T19:35:16+00:00 | Vulnerability · Source |
| CVE-2026-5061 | redhat_vex | Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack | known not affected: 1 | 2026-06-05T19:35:16+00:00 | Vulnerability · Source |
| CVE-2026-5715 | redhat_vex | Voyage Plus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode | known not affected: 1 | 2026-06-05T19:35:16+00:00 | Vulnerability · Source |
| CVE-2026-5797 | redhat_vex | Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields | known not affected: 1 | 2026-06-05T19:35:16+00:00 | Vulnerability · Source |
| CVE-2026-5502 | redhat_vex | Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order | known not affected: 1 | 2026-06-05T19:35:15+00:00 | Vulnerability · Source |
| CVE-2026-5380 | redhat_vex | runZero Platform cleartext secret exposure | known not affected: 1 | 2026-06-05T19:35:15+00:00 | Vulnerability · Source |
| CVE-2026-5191 | redhat_vex | Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title' | known not affected: 1 | 2026-06-05T19:35:14+00:00 | Vulnerability · Source |
| CVE-2026-5074 | redhat_vex | ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter | known not affected: 1 | 2026-06-05T19:35:14+00:00 | Vulnerability · Source |
| CVE-2026-5340 | redhat_vex | Fancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:35:14+00:00 | Vulnerability · Source |
| CVE-2026-5841 | redhat_vex | Tenda i3 HTTP R7WebsSecurityHandler path traversal | known not affected: 1 | 2026-06-05T19:35:14+00:00 | Vulnerability · Source |
| CVE-2026-5362 | redhat_vex | Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering | known not affected: 1 | 2026-06-05T19:35:13+00:00 | Vulnerability · Source |
| CVE-2026-5506 | redhat_vex | Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:35:13+00:00 | Vulnerability · Source |
| CVE-2026-5739 | redhat_vex | PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection | known not affected: 1 | 2026-06-05T19:35:12+00:00 | Vulnerability · Source |
| CVE-2026-5308 | redhat_vex | Missing request body size limits on Zoom plugin HTTP endpoints | known not affected: 1 | 2026-06-05T19:35:12+00:00 | Vulnerability · Source |
| CVE-2026-5748 | redhat_vex | Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:35:12+00:00 | Vulnerability · Source |