VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298227 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-48189 | redhat_vex | Bypass DedicatedAgentToCustomerGroups Setting | known not affected: 1 | 2026-06-05T19:26:20+00:00 | Vulnerability · Source |
| CVE-2026-48066 | redhat_vex | pam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authentication | known not affected: 1 | 2026-06-05T19:26:20+00:00 | Vulnerability · Source |
| CVE-2026-48903 | redhat_vex | Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code. | known not affected: 1 | 2026-06-05T19:26:19+00:00 | Vulnerability · Source |
| CVE-2026-48480 | redhat_vex | netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation | known not affected: 1 | 2026-06-05T19:26:19+00:00 | Vulnerability · Source |
| CVE-2026-48219 | redhat_vex | Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter | known not affected: 1 | 2026-06-05T19:26:18+00:00 | Vulnerability · Source |
| CVE-2026-48213 | redhat_vex | Open ISES Tickets < 3.44.2 Reflected XSS via add.php ticket_id Parameter | known not affected: 1 | 2026-06-05T19:26:18+00:00 | Vulnerability · Source |
| CVE-2026-48877 | redhat_vex | WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability | known not affected: 1 | 2026-06-05T19:26:17+00:00 | Vulnerability · Source |
| CVE-2026-48905 | redhat_vex | Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code. | known not affected: 1 | 2026-06-05T19:26:16+00:00 | Vulnerability · Source |
| CVE-2026-48222 | redhat_vex | Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter | known not affected: 1 | 2026-06-05T19:26:16+00:00 | Vulnerability · Source |
| CVE-2026-48792 | redhat_vex | pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution | known not affected: 1 | 2026-06-05T19:26:15+00:00 | Vulnerability · Source |
| CVE-2026-48244 | redhat_vex | Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php | known not affected: 1 | 2026-06-05T19:26:15+00:00 | Vulnerability · Source |
| CVE-2026-48208 | redhat_vex | Denial-of-Service via SVG Rendering in Ticket | known not affected: 1 | 2026-06-05T19:26:14+00:00 | Vulnerability · Source |
| CVE-2026-39810 | redhat_vex | CVE-2026-39810 | known not affected: 1 | 2026-06-05T19:26:14+00:00 | Vulnerability · Source |
| CVE-2026-48226 | redhat_vex | Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters | known not affected: 1 | 2026-06-05T19:26:14+00:00 | Vulnerability · Source |
| CVE-2026-39410 | redhat_vex | Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() | known not affected: 1 | 2026-06-05T19:26:13+00:00 | Vulnerability · Source |
| CVE-2026-48899 | redhat_vex | Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins | known not affected: 1 | 2026-06-05T19:26:13+00:00 | Vulnerability · Source |
| CVE-2026-48217 | redhat_vex | Open ISES Tickets < 3.44.2 Reflected XSS via delete_module.php Multiple POST Parameters | known not affected: 1 | 2026-06-05T19:26:13+00:00 | Vulnerability · Source |
| CVE-2026-39360 | redhat_vex | RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration | known not affected: 1 | 2026-06-05T19:26:12+00:00 | Vulnerability · Source |
| CVE-2026-39423 | redhat_vex | Stored XSS via Eval Injection in EchartsRander Component | known not affected: 1 | 2026-06-05T19:26:12+00:00 | Vulnerability · Source |
| CVE-2026-39809 | redhat_vex | CVE-2026-39809 | known not affected: 1 | 2026-06-05T19:26:11+00:00 | Vulnerability · Source |
| CVE-2026-39845 | redhat_vex | Weblate: SSRF via the webhook add-on using unprotected fetch_url() | known not affected: 1 | 2026-06-05T19:26:11+00:00 | Vulnerability · Source |
| CVE-2026-39368 | redhat_vex | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | known not affected: 1 | 2026-06-05T19:26:11+00:00 | Vulnerability · Source |
| CVE-2026-39311 | redhat_vex | Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments | known not affected: 1 | 2026-06-05T19:26:10+00:00 | Vulnerability · Source |
| CVE-2026-39593 | redhat_vex | WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:26:10+00:00 | Vulnerability · Source |
| CVE-2026-39966 | redhat_vex | TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and leaking cross-workspace bot definitions | known not affected: 1 | 2026-06-05T19:26:08+00:00 | Vulnerability · Source |
| CVE-2026-39401 | redhat_vex | Privilege Escalation via update_event Job Output in Cronicle | known not affected: 1 | 2026-06-05T19:26:08+00:00 | Vulnerability · Source |
| CVE-2026-39409 | redhat_vex | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses | known not affected: 1 | 2026-06-05T19:26:07+00:00 | Vulnerability · Source |
| CVE-2026-39814 | redhat_vex | CVE-2026-39814 | known not affected: 1 | 2026-06-05T19:26:06+00:00 | Vulnerability · Source |
| CVE-2026-39841 | redhat_vex | Stored XSS through list fields on Cargo's page values and Special:CargoTables | known not affected: 1 | 2026-06-05T19:26:06+00:00 | Vulnerability · Source |
| CVE-2026-39418 | redhat_vex | MaxKB: SSRF via sandbox network hook bypass | known not affected: 1 | 2026-06-05T19:26:06+00:00 | Vulnerability · Source |
| CVE-2026-39412 | redhat_vex | LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel | known not affected: 1 | 2026-06-05T19:26:05+00:00 | Vulnerability · Source |
| CVE-2026-39391 | redhat_vex | CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List | known not affected: 1 | 2026-06-05T19:26:05+00:00 | Vulnerability · Source |
| CVE-2026-39960 | redhat_vex | MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values | known not affected: 1 | 2026-06-05T19:26:04+00:00 | Vulnerability · Source |
| CVE-2026-39421 | redhat_vex | MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect | known not affected: 1 | 2026-06-05T19:26:04+00:00 | Vulnerability · Source |
| CVE-2026-39964 | redhat_vex | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | known not affected: 1 | 2026-06-05T19:26:04+00:00 | Vulnerability · Source |
| CVE-2026-39407 | redhat_vex | Hono has a middleware bypass via repeated slashes in serveStatic | known not affected: 1 | 2026-06-05T19:26:03+00:00 | Vulnerability · Source |
| CVE-2026-39425 | redhat_vex | MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering | known not affected: 1 | 2026-06-05T19:26:03+00:00 | Vulnerability · Source |
| CVE-2026-39380 | redhat_vex | Open Source Point of Sale has Stored XSS in Stock Location (Configuration) | known not affected: 1 | 2026-06-05T19:26:02+00:00 | Vulnerability · Source |
| CVE-2026-39422 | redhat_vex | MaxKB has Stored XSS via ChatHeadersMiddleware | known not affected: 1 | 2026-06-05T19:26:02+00:00 | Vulnerability · Source |
| CVE-2026-39812 | redhat_vex | CVE-2026-39812 | known not affected: 1 | 2026-06-05T19:26:02+00:00 | Vulnerability · Source |
| CVE-2026-39655 | redhat_vex | WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:26:01+00:00 | Vulnerability · Source |
| CVE-2026-39969 | redhat_vex | TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification | known not affected: 1 | 2026-06-05T19:26:01+00:00 | Vulnerability · Source |
| CVE-2026-39862 | redhat_vex | Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link | known not affected: 1 | 2026-06-05T19:26:01+00:00 | Vulnerability · Source |
| CVE-2026-39839 | redhat_vex | Stored XSS through URLs in Cargo's map format | known not affected: 1 | 2026-06-05T19:26:00+00:00 | Vulnerability · Source |
| CVE-2026-39844 | redhat_vex | NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization | known not affected: 1 | 2026-06-05T19:26:00+00:00 | Vulnerability · Source |
| CVE-2026-39857 | redhat_vex | Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions | known not affected: 1 | 2026-06-05T19:25:59+00:00 | Vulnerability · Source |
| CVE-2026-39848 | redhat_vex | Dockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation | known not affected: 1 | 2026-06-05T19:25:59+00:00 | Vulnerability · Source |
| CVE-2026-39417 | redhat_vex | MaxKB: RCE via MCP stdio command injection in workflow engine | known not affected: 1 | 2026-06-05T19:25:58+00:00 | Vulnerability · Source |
| CVE-2026-39390 | redhat_vex | CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting | known not affected: 1 | 2026-06-05T19:25:58+00:00 | Vulnerability · Source |
| CVE-2026-39336 | redhat_vex | ChurchCRM has Stored XSS from unescaped config values in HTML attributes | known not affected: 1 | 2026-06-05T19:25:57+00:00 | Vulnerability · Source |