VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298249 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-44213 | redhat_vex | OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured | known not affected: 1 | 2026-06-05T19:24:52+00:00 | Vulnerability · Source |
| CVE-2026-44972 | redhat_vex | GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content | known not affected: 1 | 2026-06-05T19:24:52+00:00 | Vulnerability · Source |
| CVE-2026-44679 | redhat_vex | Tuist: Forgot password flow lacks throttling for reset email delivery | known not affected: 1 | 2026-06-05T19:24:51+00:00 | Vulnerability · Source |
| CVE-2026-44994 | redhat_vex | OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint | known not affected: 1 | 2026-06-05T19:24:51+00:00 | Vulnerability · Source |
| CVE-2026-44501 | redhat_vex | DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability | known not affected: 1 | 2026-06-05T19:24:50+00:00 | Vulnerability · Source |
| CVE-2026-44437 | redhat_vex | Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix | known not affected: 1 | 2026-06-05T19:24:49+00:00 | Vulnerability · Source |
| CVE-2026-44392 | redhat_vex | CVE-2026-44392 | known not affected: 1 | 2026-06-05T19:24:49+00:00 | Vulnerability · Source |
| CVE-2026-44347 | redhat_vex | Warpgate: SSO CSRF -- State Token Not Validated on Return | known not affected: 1 | 2026-06-05T19:24:49+00:00 | Vulnerability · Source |
| CVE-2026-44653 | redhat_vex | LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets | known not affected: 1 | 2026-06-05T19:24:48+00:00 | Vulnerability · Source |
| CVE-2026-8238 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation message | known not affected: 1 | 2026-06-05T19:24:47+00:00 | Vulnerability · Source |
| CVE-2026-8418 | redhat_vex | Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion | known not affected: 1 | 2026-06-05T19:24:46+00:00 | Vulnerability · Source |
| CVE-2026-8814 | redhat_vex | CVE-2026-8814 | known not affected: 1 | 2026-06-05T19:24:46+00:00 | Vulnerability · Source |
| CVE-2026-8131 | redhat_vex | SourceCodester SUP Online Shopping replymsg.php sql injection | known not affected: 1 | 2026-06-05T19:24:45+00:00 | Vulnerability · Source |
| CVE-2026-8337 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys | known not affected: 1 | 2026-06-05T19:24:45+00:00 | Vulnerability · Source |
| CVE-2026-8867 | redhat_vex | Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:44+00:00 | Vulnerability · Source |
| CVE-2026-8885 | redhat_vex | DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:44+00:00 | Vulnerability · Source |
| CVE-2026-8768 | redhat_vex | vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery | known not affected: 1 | 2026-06-05T19:24:43+00:00 | Vulnerability · Source |
| CVE-2026-8894 | redhat_vex | iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:42+00:00 | Vulnerability · Source |
| CVE-2026-8939 | redhat_vex | Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update | known not affected: 1 | 2026-06-05T19:24:42+00:00 | Vulnerability · Source |
| CVE-2026-8993 | redhat_vex | Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks | known not affected: 1 | 2026-06-05T19:24:42+00:00 | Vulnerability · Source |
| CVE-2026-8144 | redhat_vex | Missing Authorization in GitLab | known not affected: 1 | 2026-06-05T19:24:41+00:00 | Vulnerability · Source |
| CVE-2026-8702 | redhat_vex | GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:24:41+00:00 | Vulnerability · Source |
| CVE-2026-8405 | redhat_vex | IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability | known not affected: 1 | 2026-06-05T19:24:40+00:00 | Vulnerability · Source |
| CVE-2026-8027 | redhat_vex | FlowiseAI Flowise User Controller authorization | known not affected: 1 | 2026-06-05T19:24:40+00:00 | Vulnerability · Source |
| CVE-2026-8423 | redhat_vex | JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery | known not affected: 1 | 2026-06-05T19:24:40+00:00 | Vulnerability · Source |
| CVE-2026-8898 | redhat_vex | Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:40+00:00 | Vulnerability · Source |
| CVE-2026-8845 | redhat_vex | Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:39+00:00 | Vulnerability · Source |
| CVE-2026-8485 | redhat_vex | Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation | known not affected: 1 | 2026-06-05T19:24:39+00:00 | Vulnerability · Source |
| CVE-2026-8038 | redhat_vex | Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:24:39+00:00 | Vulnerability · Source |
| CVE-2026-8692 | redhat_vex | Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action | known not affected: 1 | 2026-06-05T19:24:38+00:00 | Vulnerability · Source |
| CVE-2026-8098 | redhat_vex | code-projects Feedback System checklogin.php sql injection | known not affected: 1 | 2026-06-05T19:24:37+00:00 | Vulnerability · Source |
| CVE-2026-8425 | redhat_vex | Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update | known not affected: 1 | 2026-06-05T19:24:36+00:00 | Vulnerability · Source |
| CVE-2026-8872 | redhat_vex | Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:36+00:00 | Vulnerability · Source |
| CVE-2026-8911 | redhat_vex | WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter | known not affected: 1 | 2026-06-05T19:24:36+00:00 | Vulnerability · Source |
| CVE-2026-8236 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} | known not affected: 1 | 2026-06-05T19:24:35+00:00 | Vulnerability · Source |
| CVE-2026-8245 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | known not affected: 1 | 2026-06-05T19:24:34+00:00 | Vulnerability · Source |
| CVE-2026-8605 | redhat_vex | Use of Hard-coded Credentials in ScadaBR | known not affected: 1 | 2026-06-05T19:24:34+00:00 | Vulnerability · Source |
| CVE-2026-8083 | redhat_vex | SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection | known not affected: 1 | 2026-06-05T19:24:34+00:00 | Vulnerability · Source |
| CVE-2026-8847 | redhat_vex | Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:33+00:00 | Vulnerability · Source |
| CVE-2026-8685 | redhat_vex | Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter | known not affected: 1 | 2026-06-05T19:24:33+00:00 | Vulnerability · Source |
| CVE-2026-8201 | redhat_vex | Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields | known not affected: 1 | 2026-06-05T19:24:32+00:00 | Vulnerability · Source |
| CVE-2026-8487 | redhat_vex | Incorrect default permissions vulnerability in Progress Software MOVEit Automation | known not affected: 1 | 2026-06-05T19:24:32+00:00 | Vulnerability · Source |
| CVE-2026-8610 | redhat_vex | TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter | known not affected: 1 | 2026-06-05T19:24:31+00:00 | Vulnerability · Source |
| CVE-2026-8052 | redhat_vex | Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack | known not affected: 1 | 2026-06-05T19:24:31+00:00 | Vulnerability · Source |
| CVE-2026-8887 | redhat_vex | Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-06-05T19:24:31+00:00 | Vulnerability · Source |
| CVE-2026-8869 | redhat_vex | Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute | known not affected: 1 | 2026-06-05T19:24:30+00:00 | Vulnerability · Source |
| CVE-2026-8133 | redhat_vex | zyx0814 FilePress Shares Filelist API admin.php sql injection | known not affected: 1 | 2026-06-05T19:24:30+00:00 | Vulnerability · Source |
| CVE-2026-8689 | redhat_vex | Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions | known not affected: 1 | 2026-06-05T19:24:30+00:00 | Vulnerability · Source |
| CVE-2026-8995 | redhat_vex | Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action | known not affected: 1 | 2026-06-05T19:24:29+00:00 | Vulnerability · Source |
| CVE-2026-8205 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar | known not affected: 1 | 2026-06-05T19:24:29+00:00 | Vulnerability · Source |