VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298247 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-44559 | redhat_vex | Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels | known not affected: 1 | 2026-06-05T19:25:19+00:00 | Vulnerability · Source |
| CVE-2026-44775 | redhat_vex | Kavita: No authentication at /api/Reader/image | known not affected: 1 | 2026-06-05T19:25:18+00:00 | Vulnerability · Source |
| CVE-2026-44379 | redhat_vex | MISP: Improper UUID validation in MISP Collections | known not affected: 1 | 2026-06-05T19:25:17+00:00 | Vulnerability · Source |
| CVE-2026-44298 | redhat_vex | Kimai: Arbitrary file read in invoice PDF renderer (admin) | known not affected: 1 | 2026-06-05T19:25:17+00:00 | Vulnerability · Source |
| CVE-2026-44568 | redhat_vex | Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order | known not affected: 1 | 2026-06-05T19:25:16+00:00 | Vulnerability · Source |
| CVE-2026-44995 | redhat_vex | OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables | known not affected: 1 | 2026-06-05T19:25:16+00:00 | Vulnerability · Source |
| CVE-2026-44520 | redhat_vex | Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler | known not affected: 1 | 2026-06-05T19:25:15+00:00 | Vulnerability · Source |
| CVE-2026-44195 | redhat_vex | OPNsense: Authentication lockout bypass | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44430 | redhat_vex | MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44214 | redhat_vex | eventsource-encoder: SSE event injection via unsanitized event and id fields | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44788 | redhat_vex | SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant) | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44366 | redhat_vex | Vvveb: Stored XSS via Comment Author Field | known not affected: 1 | 2026-06-05T19:25:13+00:00 | Vulnerability · Source |
| CVE-2026-44456 | redhat_vex | Hono: bodyLimit() can be bypassed for chunked / unknown-length requests | known not affected: 1 | 2026-06-05T19:25:13+00:00 | Vulnerability · Source |
| CVE-2026-44654 | redhat_vex | LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents | known not affected: 1 | 2026-06-05T19:25:12+00:00 | Vulnerability · Source |
| CVE-2026-44429 | redhat_vex | MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` | known not affected: 1 | 2026-06-05T19:25:12+00:00 | Vulnerability · Source |
| CVE-2026-44564 | redhat_vex | Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO | known not affected: 1 | 2026-06-05T19:25:11+00:00 | Vulnerability · Source |
| CVE-2026-44372 | redhat_vex | Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules | known not affected: 1 | 2026-06-05T19:25:10+00:00 | Vulnerability · Source |
| CVE-2026-44318 | redhat_vex | free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions | known not affected: 1 | 2026-06-05T19:25:10+00:00 | Vulnerability · Source |
| CVE-2026-44426 | redhat_vex | ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check | known not affected: 1 | 2026-06-05T19:25:09+00:00 | Vulnerability · Source |
| CVE-2026-44264 | redhat_vex | Weblate is vulnerable to XSS via crafted Markdown | known not affected: 1 | 2026-06-05T19:25:09+00:00 | Vulnerability · Source |
| CVE-2026-44695 | redhat_vex | Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity | known not affected: 1 | 2026-06-05T19:25:08+00:00 | Vulnerability · Source |
| CVE-2026-44408 | redhat_vex | Unauthorized access vulnerability in ZTE MU5250 | known not affected: 1 | 2026-06-05T19:25:08+00:00 | Vulnerability · Source |
| CVE-2026-44903 | redhat_vex | Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI | known not affected: 1 | 2026-06-05T19:25:08+00:00 | Vulnerability · Source |
| CVE-2026-44363 | redhat_vex | Unsafe remote resource fetching in expansion misp-modules | known not affected: 1 | 2026-06-05T19:25:07+00:00 | Vulnerability · Source |
| CVE-2026-44561 | redhat_vex | Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels | known not affected: 1 | 2026-06-05T19:25:06+00:00 | Vulnerability · Source |
| CVE-2026-44749 | redhat_vex | Information Disclosure vulnerability in SAP Gateway | known not affected: 1 | 2026-06-05T19:25:05+00:00 | Vulnerability · Source |
| CVE-2026-44884 | redhat_vex | Portainer: Missing authorization on custom template file endpoint exposes template content | known not affected: 1 | 2026-06-05T19:25:04+00:00 | Vulnerability · Source |
| CVE-2026-44776 | redhat_vex | Kavita: IDOR in /api/Download/* | known not affected: 1 | 2026-06-05T19:25:04+00:00 | Vulnerability · Source |
| CVE-2026-44301 | redhat_vex | Hugo: Node tool execution allows file system access outside the project directory | known not affected: 1 | 2026-06-05T19:25:03+00:00 | Vulnerability · Source |
| CVE-2026-44710 | redhat_vex | pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service | known not affected: 1 | 2026-06-05T19:25:02+00:00 | Vulnerability · Source |
| CVE-2026-44314 | redhat_vex | Traccar: Missing edit authorization on device image upload allows read-only users to write files | known not affected: 1 | 2026-06-05T19:25:02+00:00 | Vulnerability · Source |
| CVE-2026-44479 | redhat_vex | Vercel: Non-interactive mode includes CLI arguments in suggested command output | known not affected: 1 | 2026-06-05T19:25:02+00:00 | Vulnerability · Source |
| CVE-2026-44341 | redhat_vex | GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint | known not affected: 1 | 2026-06-05T19:25:01+00:00 | Vulnerability · Source |
| CVE-2026-44611 | redhat_vex | MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort | known not affected: 1 | 2026-06-05T19:25:01+00:00 | Vulnerability · Source |
| CVE-2026-44305 | redhat_vex | Lemur: LDAP TLS certificate verification globally disabled enables credential interception | known not affected: 1 | 2026-06-05T19:25:01+00:00 | Vulnerability · Source |
| CVE-2026-44844 | redhat_vex | eml_parser: Recursion DoS via nested message/rfc822 attachments | known not affected: 1 | 2026-06-05T19:25:00+00:00 | Vulnerability · Source |
| CVE-2026-44996 | redhat_vex | OpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding | known not affected: 1 | 2026-06-05T19:25:00+00:00 | Vulnerability · Source |
| CVE-2026-44440 | redhat_vex | ERPNext: Path Traversal Leading to Sensitive File Exposure | known not affected: 1 | 2026-06-05T19:25:00+00:00 | Vulnerability · Source |
| CVE-2026-44259 | redhat_vex | efw4.X: Stored XSS via previewServlet | known not affected: 1 | 2026-06-05T19:24:59+00:00 | Vulnerability · Source |
| CVE-2026-44448 | redhat_vex | ERPNext: Unauthorised Document modification due to missing validation | known not affected: 1 | 2026-06-05T19:24:59+00:00 | Vulnerability · Source |
| CVE-2026-44550 | redhat_vex | Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts | known not affected: 1 | 2026-06-05T19:24:57+00:00 | Vulnerability · Source |
| CVE-2026-44352 | redhat_vex | Flowsint: Broken Access Control allows reading of sketch logs from any user | known not affected: 1 | 2026-06-05T19:24:56+00:00 | Vulnerability · Source |
| CVE-2026-44640 | redhat_vex | NanoMQ: QUIC Dialer Close Type Confusion | known not affected: 1 | 2026-06-05T19:24:56+00:00 | Vulnerability · Source |
| CVE-2026-44406 | redhat_vex | DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview | known not affected: 1 | 2026-06-05T19:24:56+00:00 | Vulnerability · Source |
| CVE-2026-44424 | redhat_vex | ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace | known not affected: 1 | 2026-06-05T19:24:55+00:00 | Vulnerability · Source |
| CVE-2026-44226 | redhat_vex | pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI | known not affected: 1 | 2026-06-05T19:24:55+00:00 | Vulnerability · Source |
| CVE-2026-44200 | redhat_vex | Wagtail: Improper permission handling when copying pages | known not affected: 1 | 2026-06-05T19:24:53+00:00 | Vulnerability · Source |
| CVE-2026-44198 | redhat_vex | Wagtail: Improper permission handling when viewing page history | known not affected: 1 | 2026-06-05T19:24:53+00:00 | Vulnerability · Source |
| CVE-2026-44213 | redhat_vex | OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured | known not affected: 1 | 2026-06-05T19:24:52+00:00 | Vulnerability · Source |
| CVE-2026-44972 | redhat_vex | GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content | known not affected: 1 | 2026-06-05T19:24:52+00:00 | Vulnerability · Source |