VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298280 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-43633 | redhat_vex | HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal | known not affected: 1 | 2026-06-05T19:23:00+00:00 | Vulnerability · Source |
| CVE-2026-43624 | redhat_vex | F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project() | known not affected: 1 | 2026-06-05T19:23:00+00:00 | Vulnerability · Source |
| CVE-2026-43893 | redhat_vex | exiftool-vendored: Argument injection via newline characters in tag names | known not affected: 1 | 2026-06-05T19:22:59+00:00 | Vulnerability · Source |
| CVE-2026-43938 | redhat_vex | YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header | known not affected: 1 | 2026-06-05T19:22:59+00:00 | Vulnerability · Source |
| CVE-2026-43888 | redhat_vex | Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import | known not affected: 1 | 2026-06-05T19:22:58+00:00 | Vulnerability · Source |
| CVE-2026-43530 | redhat_vex | OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution | known not affected: 1 | 2026-06-05T19:22:58+00:00 | Vulnerability · Source |
| CVE-2026-43916 | redhat_vex | pam_authnft: Heap buffer overflow in NETLINK_SOCK_DIAG reply walker | known not affected: 1 | 2026-06-05T19:22:57+00:00 | Vulnerability · Source |
| CVE-2026-43943 | redhat_vex | electerm: RCE via malicious SSH server filename in openFileWithEditor | known not affected: 1 | 2026-06-05T19:22:57+00:00 | Vulnerability · Source |
| CVE-2026-43625 | redhat_vex | CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect | known not affected: 1 | 2026-06-05T19:22:57+00:00 | Vulnerability · Source |
| CVE-2026-43897 | redhat_vex | Link Preview JS: vunerable to IPv6 and internal loopback attacks | known not affected: 1 | 2026-06-05T19:22:57+00:00 | Vulnerability · Source |
| CVE-2026-43526 | redhat_vex | OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling | known not affected: 1 | 2026-06-05T19:22:56+00:00 | Vulnerability · Source |
| CVE-2026-43940 | redhat_vex | electerm: Path traversal in electerm runWidget leads to arbitrary code execution | known not affected: 1 | 2026-06-05T19:22:56+00:00 | Vulnerability · Source |
| CVE-2026-43571 | redhat_vex | OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup | known not affected: 1 | 2026-06-05T19:22:56+00:00 | Vulnerability · Source |
| CVE-2026-43634 | redhat_vex | HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header | known not affected: 1 | 2026-06-05T19:22:55+00:00 | Vulnerability · Source |
| CVE-2026-43535 | redhat_vex | OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches | known not affected: 1 | 2026-06-05T19:22:55+00:00 | Vulnerability · Source |
| CVE-2026-43984 | redhat_vex | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | known not affected: 1 | 2026-06-05T19:22:54+00:00 | Vulnerability · Source |
| CVE-2026-43948 | redhat_vex | wger: cross-tenant password reset and plaintext disclosure via gym=None bypass | known not affected: 1 | 2026-06-05T19:22:54+00:00 | Vulnerability · Source |
| CVE-2026-43900 | redhat_vex | DeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`) | known not affected: 1 | 2026-06-05T19:22:54+00:00 | Vulnerability · Source |
| CVE-2026-43991 | redhat_vex | JunoClaw: plugin-shell shell-injection bypass via substring blocklist | known not affected: 1 | 2026-06-05T19:22:54+00:00 | Vulnerability · Source |
| CVE-2026-43988 | redhat_vex | Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing | known not affected: 1 | 2026-06-05T19:22:53+00:00 | Vulnerability · Source |
| CVE-2026-43531 | redhat_vex | OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File | known not affected: 1 | 2026-06-05T19:22:53+00:00 | Vulnerability · Source |
| CVE-2026-43898 | redhat_vex | SandboxJS: Sandbox escape via Function.caller leakage of internal call op | known not affected: 1 | 2026-06-05T19:22:53+00:00 | Vulnerability · Source |
| CVE-2026-43935 | redhat_vex | e107: Host Header Injection in e107 password reset enables phishing | known not affected: 1 | 2026-06-05T19:22:52+00:00 | Vulnerability · Source |
| CVE-2026-43566 | redhat_vex | OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events | known not affected: 1 | 2026-06-05T19:22:52+00:00 | Vulnerability · Source |
| CVE-2026-43937 | redhat_vex | YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql` | known not affected: 1 | 2026-06-05T19:22:51+00:00 | Vulnerability · Source |
| CVE-2026-43892 | redhat_vex | AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection | known not affected: 1 | 2026-06-05T19:22:51+00:00 | Vulnerability · Source |
| CVE-2026-43874 | redhat_vex | WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass | known not affected: 1 | 2026-06-05T19:22:51+00:00 | Vulnerability · Source |
| CVE-2026-43982 | redhat_vex | Algernon: Path traversal file write via savein() | known not affected: 1 | 2026-06-05T19:22:50+00:00 | Vulnerability · Source |
| CVE-2026-7068 | redhat_vex | D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow | known not affected: 1 | 2026-06-05T19:22:50+00:00 | Vulnerability · Source |
| CVE-2026-43986 | redhat_vex | Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay | known not affected: 1 | 2026-06-05T19:22:50+00:00 | Vulnerability · Source |
| CVE-2026-7123 | redhat_vex | Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection | known not affected: 1 | 2026-06-05T19:22:49+00:00 | Vulnerability · Source |
| CVE-2026-7365 | redhat_vex | IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation | known not affected: 1 | 2026-06-05T19:22:49+00:00 | Vulnerability · Source |
| CVE-2026-7330 | redhat_vex | Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter | known not affected: 1 | 2026-06-05T19:22:49+00:00 | Vulnerability · Source |
| CVE-2026-7428 | redhat_vex | Insecure default administrative credentials in AlloyDB for PostgreSQL | known not affected: 1 | 2026-06-05T19:22:49+00:00 | Vulnerability · Source |
| CVE-2026-7851 | redhat_vex | D-Link DI-8100 yyxz.asp sprintf stack-based overflow | known not affected: 1 | 2026-06-05T19:22:48+00:00 | Vulnerability · Source |
| CVE-2026-7284 | redhat_vex | Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register | known not affected: 1 | 2026-06-05T19:22:48+00:00 | Vulnerability · Source |
| CVE-2026-7635 | redhat_vex | coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field | known not affected: 1 | 2026-06-05T19:22:47+00:00 | Vulnerability · Source |
| CVE-2026-7770 | redhat_vex | IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator | known not affected: 1 | 2026-06-05T19:22:47+00:00 | Vulnerability · Source |
| CVE-2026-7802 | redhat_vex | Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter | known not affected: 1 | 2026-06-05T19:22:47+00:00 | Vulnerability · Source |
| CVE-2026-7419 | redhat_vex | UTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow | known not affected: 1 | 2026-06-05T19:22:47+00:00 | Vulnerability · Source |
| CVE-2026-7204 | redhat_vex | Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection | known not affected: 1 | 2026-06-05T19:22:46+00:00 | Vulnerability · Source |
| CVE-2026-7420 | redhat_vex | UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow | known not affected: 1 | 2026-06-05T19:22:46+00:00 | Vulnerability · Source |
| CVE-2026-7136 | redhat_vex | Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection | known not affected: 1 | 2026-06-05T19:22:45+00:00 | Vulnerability · Source |
| CVE-2026-7424 | redhat_vex | Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP | known not affected: 1 | 2026-06-05T19:22:44+00:00 | Vulnerability · Source |
| CVE-2026-7460 | redhat_vex | mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped | known not affected: 1 | 2026-06-05T19:22:44+00:00 | Vulnerability · Source |
| CVE-2026-7244 | redhat_vex | Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection | known not affected: 1 | 2026-06-05T19:22:43+00:00 | Vulnerability · Source |
| CVE-2026-7280 | redhat_vex | eMPIA Technology｜AVACAST - Unquoted Service Path | known not affected: 1 | 2026-06-05T19:22:43+00:00 | Vulnerability · Source |
| CVE-2026-7613 | redhat_vex | Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import | known not affected: 1 | 2026-06-05T19:22:42+00:00 | Vulnerability · Source |
| CVE-2026-7451 | redhat_vex | TIF File Parsing Out-of-Bounds Write in Autodesk 3ds Max | known not affected: 1 | 2026-06-05T19:22:42+00:00 | Vulnerability · Source |
| CVE-2026-7415 | redhat_vex | Open MQTT orchestration without read/write ACLs in Yarbo robot firmware | known not affected: 1 | 2026-06-05T19:22:42+00:00 | Vulnerability · Source |