VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297765 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-42276 | redhat_vex | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions | known not affected: 1 | 2026-06-05T19:30:52+00:00 | Vulnerability · Source |
| CVE-2026-42348 | redhat_vex | OpAMP client reads unbounded HTTP response bodies | known not affected: 1 | 2026-06-05T19:30:51+00:00 | Vulnerability · Source |
| CVE-2026-42744 | redhat_vex | WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability | known not affected: 1 | 2026-06-05T19:30:51+00:00 | Vulnerability · Source |
| CVE-2026-42267 | redhat_vex | Kimai: Formula Injection via tag names in XLSX export | known not affected: 1 | 2026-06-05T19:30:51+00:00 | Vulnerability · Source |
| CVE-2026-42159 | redhat_vex | Flowsint: Stored XSS in description of node | known not affected: 1 | 2026-06-05T19:30:50+00:00 | Vulnerability · Source |
| CVE-2026-42078 | redhat_vex | PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image | known not affected: 1 | 2026-06-05T19:30:50+00:00 | Vulnerability · Source |
| CVE-2026-42951 | redhat_vex | MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials | known not affected: 1 | 2026-06-05T19:30:50+00:00 | Vulnerability · Source |
| CVE-2026-42227 | redhat_vex | n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure | known not affected: 1 | 2026-06-05T19:30:49+00:00 | Vulnerability · Source |
| CVE-2026-42870 | redhat_vex | WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao' | known not affected: 1 | 2026-06-05T19:30:49+00:00 | Vulnerability · Source |
| CVE-2026-42085 | redhat_vex | OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames | known not affected: 1 | 2026-06-05T19:30:48+00:00 | Vulnerability · Source |
| CVE-2026-42438 | redhat_vex | OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads | known not affected: 1 | 2026-06-05T19:30:48+00:00 | Vulnerability · Source |
| CVE-2026-42412 | redhat_vex | WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:30:46+00:00 | Vulnerability · Source |
| CVE-2026-42610 | redhat_vex | Grav: Sensitive Information Disclosure via Accounts Service Bypass | known not affected: 1 | 2026-06-05T19:30:46+00:00 | Vulnerability · Source |
| CVE-2026-42887 | redhat_vex | Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message | known not affected: 1 | 2026-06-05T19:30:46+00:00 | Vulnerability · Source |
| CVE-2026-42191 | redhat_vex | OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter | known not affected: 1 | 2026-06-05T19:30:45+00:00 | Vulnerability · Source |
| CVE-2026-42676 | redhat_vex | WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability | known not affected: 1 | 2026-06-05T19:30:45+00:00 | Vulnerability · Source |
| CVE-2026-42795 | redhat_vex | Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root | known not affected: 1 | 2026-06-05T19:30:45+00:00 | Vulnerability · Source |
| CVE-2026-42937 | redhat_vex | iControl REST and tmsh vulnerability | known not affected: 1 | 2026-06-05T19:30:44+00:00 | Vulnerability · Source |
| CVE-2026-42337 | redhat_vex | MaxKB: Broken Access Control in MaxKB OSS URL Fetch API | known not affected: 1 | 2026-06-05T19:30:44+00:00 | Vulnerability · Source |
| CVE-2026-42841 | redhat_vex | Grav: Stored XSS via Markdown media attribute() action in Grav CMS | known not affected: 1 | 2026-06-05T19:30:44+00:00 | Vulnerability · Source |
| CVE-2026-42184 | redhat_vex | Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands | known not affected: 1 | 2026-06-05T19:30:44+00:00 | Vulnerability · Source |
| CVE-2026-42751 | redhat_vex | WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability | known not affected: 1 | 2026-06-05T19:30:43+00:00 | Vulnerability · Source |
| CVE-2026-42140 | redhat_vex | Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter | known not affected: 1 | 2026-06-05T19:30:43+00:00 | Vulnerability · Source |
| CVE-2026-42876 | redhat_vex | External Secrets Operator: Priviledge escalation with secret overwriting | known not affected: 1 | 2026-06-05T19:30:42+00:00 | Vulnerability · Source |
| CVE-2026-42320 | redhat_vex | GLPI vulnerable to arbitrary file access | known not affected: 1 | 2026-06-05T19:30:42+00:00 | Vulnerability · Source |
| CVE-2026-42063 | redhat_vex | iControl SOAP vulnerability | known not affected: 1 | 2026-06-05T19:30:41+00:00 | Vulnerability · Source |
| CVE-2026-42597 | redhat_vex | Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme | known not affected: 1 | 2026-06-05T19:30:41+00:00 | Vulnerability · Source |
| CVE-2026-42885 | redhat_vex | Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence | known not affected: 1 | 2026-06-05T19:30:41+00:00 | Vulnerability · Source |
| CVE-2026-42410 | redhat_vex | WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability | known not affected: 1 | 2026-06-05T19:30:40+00:00 | Vulnerability · Source |
| CVE-2026-42948 | redhat_vex | CVE-2026-42948 | known not affected: 1 | 2026-06-05T19:30:39+00:00 | Vulnerability · Source |
| CVE-2026-42230 | redhat_vex | n8n: Open Redirect in MCP OAuth Consent Flow | known not affected: 1 | 2026-06-05T19:30:38+00:00 | Vulnerability · Source |
| CVE-2026-42207 | redhat_vex | Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts | known not affected: 1 | 2026-06-05T19:30:37+00:00 | Vulnerability · Source |
| CVE-2026-42045 | redhat_vex | LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) | known not affected: 1 | 2026-06-05T19:30:36+00:00 | Vulnerability · Source |
| CVE-2026-42081 | redhat_vex | free5GC: UE Security Capability bypass on NGAP PathSwitchRequest | known not affected: 1 | 2026-06-05T19:30:35+00:00 | Vulnerability · Source |
| CVE-2026-42458 | redhat_vex | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) | known not affected: 1 | 2026-06-05T19:30:35+00:00 | Vulnerability · Source |
| CVE-2026-42593 | redhat_vex | Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes | known not affected: 1 | 2026-06-05T19:30:35+00:00 | Vulnerability · Source |
| CVE-2026-42872 | redhat_vex | WeGIA: Reflected XSS in listar_arquivos_etapa.php | known not affected: 1 | 2026-06-05T19:30:34+00:00 | Vulnerability · Source |
| CVE-2026-42176 | redhat_vex | Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation) | known not affected: 1 | 2026-06-05T19:30:33+00:00 | Vulnerability · Source |
| CVE-2026-42095 | redhat_vex | CVE-2026-42095 | known not affected: 1 | 2026-06-05T19:30:33+00:00 | Vulnerability · Source |
| CVE-2026-42194 | redhat_vex | Incomplete fix for CVE-2026-32812: SSRF in admidio | known not affected: 1 | 2026-06-05T19:30:31+00:00 | Vulnerability · Source |
| CVE-2026-42671 | redhat_vex | WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:30:31+00:00 | Vulnerability · Source |
| CVE-2026-42886 | redhat_vex | Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload | known not affected: 1 | 2026-06-05T19:30:30+00:00 | Vulnerability · Source |
| CVE-2026-42842 | redhat_vex | grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel | known not affected: 1 | 2026-06-05T19:30:29+00:00 | Vulnerability · Source |
| CVE-2026-42725 | redhat_vex | WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability | known not affected: 1 | 2026-06-05T19:30:29+00:00 | Vulnerability · Source |
| CVE-2026-42950 | redhat_vex | CVE-2026-42950 | known not affected: 1 | 2026-06-05T19:30:29+00:00 | Vulnerability · Source |
| CVE-2026-42086 | redhat_vex | OpenC3 COSMOS: Self-XSS in the Command Sender | known not affected: 1 | 2026-06-05T19:30:28+00:00 | Vulnerability · Source |
| CVE-2026-42185 | redhat_vex | People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation | known not affected: 1 | 2026-06-05T19:30:28+00:00 | Vulnerability · Source |
| CVE-2026-42312 | redhat_vex | pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification | known not affected: 1 | 2026-06-05T19:30:28+00:00 | Vulnerability · Source |
| CVE-2026-42150 | redhat_vex | wlc: print_html outputs API data without HTML escaping, enabling stored XSS | known not affected: 1 | 2026-06-05T19:30:27+00:00 | Vulnerability · Source |
| CVE-2026-42598 | redhat_vex | Pode: Directory Traversal is possible on Static Routes | known not affected: 1 | 2026-06-05T19:30:26+00:00 | Vulnerability · Source |