VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297766 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-4089 | redhat_vex | Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:50+00:00 | Vulnerability · Source |
| CVE-2026-4117 | redhat_vex | CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action | known not affected: 1 | 2026-06-05T19:28:50+00:00 | Vulnerability · Source |
| CVE-2026-4139 | redhat_vex | mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function | known not affected: 1 | 2026-06-05T19:28:50+00:00 | Vulnerability · Source |
| CVE-2026-4881 | redhat_vex | CVE-2026-4881 | known not affected: 1 | 2026-06-05T19:28:50+00:00 | Vulnerability · Source |
| CVE-2026-4135 | redhat_vex | CVE-2026-4135 | known not affected: 1 | 2026-06-05T19:28:49+00:00 | Vulnerability · Source |
| CVE-2026-4054 | redhat_vex | SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service | known not affected: 1 | 2026-06-05T19:28:49+00:00 | Vulnerability · Source |
| CVE-2026-4090 | redhat_vex | Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form | known not affected: 1 | 2026-06-05T19:28:48+00:00 | Vulnerability · Source |
| CVE-2026-4126 | redhat_vex | Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:48+00:00 | Vulnerability · Source |
| CVE-2026-4333 | redhat_vex | LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:48+00:00 | Vulnerability · Source |
| CVE-2026-4832 | redhat_vex | CVE-2026-4832 | known not affected: 1 | 2026-06-05T19:28:47+00:00 | Vulnerability · Source |
| CVE-2026-4081 | redhat_vex | ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:28:47+00:00 | Vulnerability · Source |
| CVE-2026-4913 | redhat_vex | CVE-2026-4913 | known not affected: 1 | 2026-06-05T19:28:46+00:00 | Vulnerability · Source |
| CVE-2026-4076 | redhat_vex | Slider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:28:46+00:00 | Vulnerability · Source |
| CVE-2026-4391 | redhat_vex | TeamSpeak 3 Server ECC Key heap-based overflow | known not affected: 1 | 2026-06-05T19:28:46+00:00 | Vulnerability · Source |
| CVE-2026-4805 | redhat_vex | Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block | known not affected: 1 | 2026-06-05T19:28:45+00:00 | Vulnerability · Source |
| CVE-2026-4085 | redhat_vex | Easy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:44+00:00 | Vulnerability · Source |
| CVE-2026-4409 | redhat_vex | Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management | known not affected: 1 | 2026-06-05T19:28:44+00:00 | Vulnerability · Source |
| CVE-2026-4795 | redhat_vex | CVE-2026-4795 | known not affected: 1 | 2026-06-05T19:28:43+00:00 | Vulnerability · Source |
| CVE-2026-4607 | redhat_vex | ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification | known not affected: 1 | 2026-06-05T19:28:43+00:00 | Vulnerability · Source |
| CVE-2026-4032 | redhat_vex | CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode | known not affected: 1 | 2026-06-05T19:28:42+00:00 | Vulnerability · Source |
| CVE-2026-4410 | redhat_vex | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service | known not affected: 1 | 2026-06-05T19:28:41+00:00 | Vulnerability · Source |
| CVE-2026-4131 | redhat_vex | WP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter | known not affected: 1 | 2026-06-05T19:28:40+00:00 | Vulnerability · Source |
| CVE-2026-4140 | redhat_vex | Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action | known not affected: 1 | 2026-06-05T19:28:40+00:00 | Vulnerability · Source |
| CVE-2026-4654 | redhat_vex | Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter | known not affected: 1 | 2026-06-05T19:28:39+00:00 | Vulnerability · Source |
| CVE-2026-4852 | redhat_vex | Image Source Control Lite – Show Image Credits and Captions <= 3.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field | known not affected: 1 | 2026-06-05T19:28:38+00:00 | Vulnerability · Source |
| CVE-2026-4078 | redhat_vex | ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:28:38+00:00 | Vulnerability · Source |
| CVE-2026-4429 | redhat_vex | OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:37+00:00 | Vulnerability · Source |
| CVE-2026-4807 | redhat_vex | Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion | known not affected: 1 | 2026-06-05T19:28:37+00:00 | Vulnerability · Source |
| CVE-2026-4160 | redhat_vex | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification | known not affected: 1 | 2026-06-05T19:28:36+00:00 | Vulnerability · Source |
| CVE-2026-4142 | redhat_vex | Sentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field | known not affected: 1 | 2026-06-05T19:28:36+00:00 | Vulnerability · Source |
| CVE-2026-4502 | redhat_vex | Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API | known not affected: 1 | 2026-06-05T19:28:36+00:00 | Vulnerability · Source |
| CVE-2026-4812 | redhat_vex | Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters | known not affected: 1 | 2026-06-05T19:28:34+00:00 | Vulnerability · Source |
| CVE-2026-4025 | redhat_vex | PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:34+00:00 | Vulnerability · Source |
| CVE-2026-4977 | redhat_vex | UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter | known not affected: 1 | 2026-06-05T19:28:34+00:00 | Vulnerability · Source |
| CVE-2026-4362 | redhat_vex | ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite | known not affected: 1 | 2026-06-05T19:28:33+00:00 | Vulnerability · Source |
| CVE-2026-4353 | redhat_vex | CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:28:33+00:00 | Vulnerability · Source |
| CVE-2026-4074 | redhat_vex | Quran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:28:33+00:00 | Vulnerability · Source |
| CVE-2026-4524 | redhat_vex | Authentication Bypass Using an Alternate Path or Channel in GitLab | known not affected: 1 | 2026-06-05T19:28:32+00:00 | Vulnerability · Source |
| CVE-2026-4919 | redhat_vex | IBM Guardium Data Protection is affected by multiple vulnerabilities | known not affected: 1 | 2026-06-05T19:28:31+00:00 | Vulnerability · Source |
| CVE-2026-4065 | redhat_vex | Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation | known not affected: 1 | 2026-06-05T19:28:31+00:00 | Vulnerability · Source |
| CVE-2026-4128 | redhat_vex | TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action | known not affected: 1 | 2026-06-05T19:28:31+00:00 | Vulnerability · Source |
| CVE-2026-4300 | redhat_vex | Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting | known not affected: 1 | 2026-06-05T19:28:30+00:00 | Vulnerability · Source |
| CVE-2026-4646 | redhat_vex | Insufficient input validation in GitHub plugin API causes denial of service | known not affected: 1 | 2026-06-05T19:28:30+00:00 | Vulnerability · Source |
| CVE-2026-4664 | redhat_vex | Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter | known not affected: 1 | 2026-06-05T19:28:29+00:00 | Vulnerability · Source |
| CVE-2026-4394 | redhat_vex | Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field | known not affected: 1 | 2026-06-05T19:28:29+00:00 | Vulnerability · Source |
| CVE-2026-4080 | redhat_vex | Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:28:29+00:00 | Vulnerability · Source |
| CVE-2026-4871 | redhat_vex | Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute | known not affected: 1 | 2026-06-05T19:28:28+00:00 | Vulnerability · Source |
| CVE-2026-4817 | redhat_vex | MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters | known not affected: 1 | 2026-06-05T19:28:28+00:00 | Vulnerability · Source |
| CVE-2026-4655 | redhat_vex | Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget | known not affected: 1 | 2026-06-05T19:28:28+00:00 | Vulnerability · Source |
| CVE-2026-4853 | redhat_vex | JetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter | known not affected: 1 | 2026-06-05T19:28:27+00:00 | Vulnerability · Source |