VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297765 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-45448 | redhat_vex | ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') | known not affected: 1 | 2026-06-05T19:33:12+00:00 | Vulnerability · Source |
| CVE-2026-45080 | redhat_vex | Klaw: Improper Access Control Allows Disclosure of Password Hash | known not affected: 1 | 2026-06-05T19:33:12+00:00 | Vulnerability · Source |
| CVE-2026-45286 | redhat_vex | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint | known not affected: 1 | 2026-06-05T19:33:12+00:00 | Vulnerability · Source |
| CVE-2026-45622 | redhat_vex | Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id | known not affected: 1 | 2026-06-05T19:33:11+00:00 | Vulnerability · Source |
| CVE-2026-45682 | redhat_vex | OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals | known not affected: 1 | 2026-06-05T19:33:10+00:00 | Vulnerability · Source |
| CVE-2026-45619 | redhat_vex | AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post | known not affected: 1 | 2026-06-05T19:33:09+00:00 | Vulnerability · Source |
| CVE-2026-45217 | redhat_vex | WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability | known not affected: 1 | 2026-06-05T19:33:08+00:00 | Vulnerability · Source |
| CVE-2026-45046 | redhat_vex | Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content | known not affected: 1 | 2026-06-05T19:33:07+00:00 | Vulnerability · Source |
| CVE-2026-45442 | redhat_vex | WordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:33:07+00:00 | Vulnerability · Source |
| CVE-2026-45307 | redhat_vex | Speakr: Open redirect in is_safe_url via parser mismatch on next parameter | known not affected: 1 | 2026-06-05T19:33:06+00:00 | Vulnerability · Source |
| CVE-2026-45684 | redhat_vex | OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers | known not affected: 1 | 2026-06-05T19:33:06+00:00 | Vulnerability · Source |
| CVE-2026-45396 | redhat_vex | Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation | known not affected: 1 | 2026-06-05T19:33:05+00:00 | Vulnerability · Source |
| CVE-2026-45387 | redhat_vex | Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) | known not affected: 1 | 2026-06-05T19:33:05+00:00 | Vulnerability · Source |
| CVE-2026-45002 | redhat_vex | OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping | known not affected: 1 | 2026-06-05T19:33:04+00:00 | Vulnerability · Source |
| CVE-2026-45231 | redhat_vex | DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields | known not affected: 1 | 2026-06-05T19:33:04+00:00 | Vulnerability · Source |
| CVE-2026-45222 | redhat_vex | Summarize Insecure Daemon Configuration File Permissions | known not affected: 1 | 2026-06-05T19:33:03+00:00 | Vulnerability · Source |
| CVE-2026-45679 | redhat_vex | OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages | known not affected: 1 | 2026-06-05T19:33:03+00:00 | Vulnerability · Source |
| CVE-2026-45284 | redhat_vex | Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate | known not affected: 1 | 2026-06-05T19:33:02+00:00 | Vulnerability · Source |
| CVE-2026-45275 | redhat_vex | Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers | known not affected: 1 | 2026-06-05T19:33:02+00:00 | Vulnerability · Source |
| CVE-2026-45554 | redhat_vex | NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes | known not affected: 1 | 2026-06-05T19:33:01+00:00 | Vulnerability · Source |
| CVE-2026-45245 | redhat_vex | Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events | known not affected: 1 | 2026-06-05T19:33:00+00:00 | Vulnerability · Source |
| CVE-2026-45551 | redhat_vex | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write | known not affected: 1 | 2026-06-05T19:33:00+00:00 | Vulnerability · Source |
| CVE-2026-45443 | redhat_vex | WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:33:00+00:00 | Vulnerability · Source |
| CVE-2026-45676 | redhat_vex | OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent | known not affected: 1 | 2026-06-05T19:32:58+00:00 | Vulnerability · Source |
| CVE-2026-45025 | redhat_vex | WeGIA: Stored XSS in html/atendido/etapa_processo.php | known not affected: 1 | 2026-06-05T19:32:58+00:00 | Vulnerability · Source |
| CVE-2026-45731 | redhat_vex | WWBN AVideo: Authenticated Arbitrary File Read in view/update.php | known not affected: 1 | 2026-06-05T19:32:58+00:00 | Vulnerability · Source |
| CVE-2026-45003 | redhat_vex | OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files | known not affected: 1 | 2026-06-05T19:32:57+00:00 | Vulnerability · Source |
| CVE-2026-45577 | redhat_vex | Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass | known not affected: 1 | 2026-06-05T19:32:57+00:00 | Vulnerability · Source |
| CVE-2026-45021 | redhat_vex | Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin | known not affected: 1 | 2026-06-05T19:32:56+00:00 | Vulnerability · Source |
| CVE-2026-45289 | redhat_vex | CloudburstMC Protocol: Partially missing validation for FULL type authentication tokens | known not affected: 1 | 2026-06-05T19:32:56+00:00 | Vulnerability · Source |
| CVE-2026-45210 | redhat_vex | WordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:32:56+00:00 | Vulnerability · Source |
| CVE-2026-45610 | redhat_vex | WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | known not affected: 1 | 2026-06-05T19:32:55+00:00 | Vulnerability · Source |
| CVE-2026-45412 | redhat_vex | MaxKB: Unauthenticated SSRF via Workflow Template Import | known not affected: 1 | 2026-06-05T19:32:55+00:00 | Vulnerability · Source |
| CVE-2026-45267 | redhat_vex | Nextcloud: Missing permission check for from submissions | known not affected: 1 | 2026-06-05T19:32:54+00:00 | Vulnerability · Source |
| CVE-2026-45582 | redhat_vex | n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters | known not affected: 1 | 2026-06-05T19:32:54+00:00 | Vulnerability · Source |
| CVE-2026-45681 | redhat_vex | OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size | known not affected: 1 | 2026-06-05T19:32:54+00:00 | Vulnerability · Source |
| CVE-2026-45306 | redhat_vex | pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory | known not affected: 1 | 2026-06-05T19:32:53+00:00 | Vulnerability · Source |
| CVE-2026-45366 | redhat_vex | typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol | known not affected: 1 | 2026-06-05T19:32:53+00:00 | Vulnerability · Source |
| CVE-2026-45081 | redhat_vex | Frappe HR: Permission Bypass in HRMS Leave Details API | known not affected: 1 | 2026-06-05T19:32:52+00:00 | Vulnerability · Source |
| CVE-2026-45027 | redhat_vex | WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php | known not affected: 1 | 2026-06-05T19:32:52+00:00 | Vulnerability · Source |
| CVE-2026-45054 | redhat_vex | CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing | known not affected: 1 | 2026-06-05T19:32:51+00:00 | Vulnerability · Source |
| CVE-2026-45153 | redhat_vex | Nextcloud: PIN bypass in PassCodeActivity via back button | known not affected: 1 | 2026-06-05T19:32:50+00:00 | Vulnerability · Source |
| CVE-2026-45773 | redhat_vex | Turborepo: Login callback CSRF/session fixation | known not affected: 1 | 2026-06-05T19:32:50+00:00 | Vulnerability · Source |
| CVE-2026-45001 | redhat_vex | OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access | known not affected: 1 | 2026-06-05T19:32:49+00:00 | Vulnerability · Source |
| CVE-2026-45719 | redhat_vex | Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API | known not affected: 1 | 2026-06-05T19:32:49+00:00 | Vulnerability · Source |
| CVE-2026-45557 | redhat_vex | Technitium DNS Server excessive DNSSEC requests | known not affected: 1 | 2026-06-05T19:32:48+00:00 | Vulnerability · Source |
| CVE-2026-45212 | redhat_vex | WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:32:47+00:00 | Vulnerability · Source |
| CVE-2026-45410 | redhat_vex | Time-based user enumeration in TREK authentication endpoint | known not affected: 1 | 2026-06-05T19:32:47+00:00 | Vulnerability · Source |
| CVE-2026-45616 | redhat_vex | Vvveb: Stored XSS in Posts allows privilege escalation via post editor | known not affected: 1 | 2026-06-05T19:32:47+00:00 | Vulnerability · Source |
| CVE-2026-45544 | redhat_vex | Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService | known not affected: 1 | 2026-06-05T19:32:46+00:00 | Vulnerability · Source |