VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298584 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-44652 | redhat_vex | SillyTavern: SSRF vulnerability in the CORS proxy middleware | known not affected: 1 | 2026-06-05T19:25:29+00:00 | Vulnerability · Source |
| CVE-2026-44373 | redhat_vex | Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules` | known not affected: 1 | 2026-06-05T19:25:29+00:00 | Vulnerability · Source |
| CVE-2026-44885 | redhat_vex | Portainer: Path traversal in backup archive extraction allows arbitrary file write | known not affected: 1 | 2026-06-05T19:25:27+00:00 | Vulnerability · Source |
| CVE-2026-44306 | redhat_vex | Statamic: Email enumeration via forgot password endpoint | known not affected: 1 | 2026-06-05T19:25:26+00:00 | Vulnerability · Source |
| CVE-2026-44423 | redhat_vex | ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data | known not affected: 1 | 2026-06-05T19:25:26+00:00 | Vulnerability · Source |
| CVE-2026-44836 | redhat_vex | view_component: Preview Route Can Dispatch Inherited Helper Methods | known not affected: 1 | 2026-06-05T19:25:26+00:00 | Vulnerability · Source |
| CVE-2026-44441 | redhat_vex | ERPNext: Possible SSRF by any authenticated user | known not affected: 1 | 2026-06-05T19:25:25+00:00 | Vulnerability · Source |
| CVE-2026-44737 | redhat_vex | grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title] | known not affected: 1 | 2026-06-05T19:25:24+00:00 | Vulnerability · Source |
| CVE-2026-44117 | redhat_vex | OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload | known not affected: 1 | 2026-06-05T19:25:24+00:00 | Vulnerability · Source |
| CVE-2026-44999 | redhat_vex | OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events | known not affected: 1 | 2026-06-05T19:25:23+00:00 | Vulnerability · Source |
| CVE-2026-44719 | redhat_vex | Mathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata | known not affected: 1 | 2026-06-05T19:25:23+00:00 | Vulnerability · Source |
| CVE-2026-44245 | redhat_vex | Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component | known not affected: 1 | 2026-06-05T19:25:22+00:00 | Vulnerability · Source |
| CVE-2026-44407 | redhat_vex | Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview | known not affected: 1 | 2026-06-05T19:25:22+00:00 | Vulnerability · Source |
| CVE-2026-44560 | redhat_vex | Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search | known not affected: 1 | 2026-06-05T19:25:22+00:00 | Vulnerability · Source |
| CVE-2026-44263 | redhat_vex | Weblate: Private Translation Enumeration via Screenshot API | known not affected: 1 | 2026-06-05T19:25:21+00:00 | Vulnerability · Source |
| CVE-2026-44308 | redhat_vex | Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications | known not affected: 1 | 2026-06-05T19:25:21+00:00 | Vulnerability · Source |
| CVE-2026-44371 | redhat_vex | Open OnDemand: Specially crafted filenames can execute javascript in the file browser | known not affected: 1 | 2026-06-05T19:25:21+00:00 | Vulnerability · Source |
| CVE-2026-44199 | redhat_vex | Wagtail: Improper permission handling when deleting form submissions | known not affected: 1 | 2026-06-05T19:25:20+00:00 | Vulnerability · Source |
| CVE-2026-44919 | redhat_vex | CVE-2026-44919 | known not affected: 1 | 2026-06-05T19:25:20+00:00 | Vulnerability · Source |
| CVE-2026-44201 | redhat_vex | Wagtail: Improper restriction handling on Documents and Images API | known not affected: 1 | 2026-06-05T19:25:20+00:00 | Vulnerability · Source |
| CVE-2026-44559 | redhat_vex | Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels | known not affected: 1 | 2026-06-05T19:25:19+00:00 | Vulnerability · Source |
| CVE-2026-44775 | redhat_vex | Kavita: No authentication at /api/Reader/image | known not affected: 1 | 2026-06-05T19:25:18+00:00 | Vulnerability · Source |
| CVE-2026-44379 | redhat_vex | MISP: Improper UUID validation in MISP Collections | known not affected: 1 | 2026-06-05T19:25:17+00:00 | Vulnerability · Source |
| CVE-2026-44298 | redhat_vex | Kimai: Arbitrary file read in invoice PDF renderer (admin) | known not affected: 1 | 2026-06-05T19:25:17+00:00 | Vulnerability · Source |
| CVE-2026-44568 | redhat_vex | Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order | known not affected: 1 | 2026-06-05T19:25:16+00:00 | Vulnerability · Source |
| CVE-2026-44995 | redhat_vex | OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables | known not affected: 1 | 2026-06-05T19:25:16+00:00 | Vulnerability · Source |
| CVE-2026-44520 | redhat_vex | Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler | known not affected: 1 | 2026-06-05T19:25:15+00:00 | Vulnerability · Source |
| CVE-2026-44195 | redhat_vex | OPNsense: Authentication lockout bypass | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44430 | redhat_vex | MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44214 | redhat_vex | eventsource-encoder: SSE event injection via unsanitized event and id fields | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44788 | redhat_vex | SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant) | known not affected: 1 | 2026-06-05T19:25:14+00:00 | Vulnerability · Source |
| CVE-2026-44366 | redhat_vex | Vvveb: Stored XSS via Comment Author Field | known not affected: 1 | 2026-06-05T19:25:13+00:00 | Vulnerability · Source |
| CVE-2026-44456 | redhat_vex | Hono: bodyLimit() can be bypassed for chunked / unknown-length requests | known not affected: 1 | 2026-06-05T19:25:13+00:00 | Vulnerability · Source |
| CVE-2026-44654 | redhat_vex | LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents | known not affected: 1 | 2026-06-05T19:25:12+00:00 | Vulnerability · Source |
| CVE-2026-44429 | redhat_vex | MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` | known not affected: 1 | 2026-06-05T19:25:12+00:00 | Vulnerability · Source |
| CVE-2026-44564 | redhat_vex | Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO | known not affected: 1 | 2026-06-05T19:25:11+00:00 | Vulnerability · Source |
| CVE-2026-44372 | redhat_vex | Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules | known not affected: 1 | 2026-06-05T19:25:10+00:00 | Vulnerability · Source |
| CVE-2026-44318 | redhat_vex | free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions | known not affected: 1 | 2026-06-05T19:25:10+00:00 | Vulnerability · Source |
| CVE-2026-44426 | redhat_vex | ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check | known not affected: 1 | 2026-06-05T19:25:09+00:00 | Vulnerability · Source |
| CVE-2026-44264 | redhat_vex | Weblate is vulnerable to XSS via crafted Markdown | known not affected: 1 | 2026-06-05T19:25:09+00:00 | Vulnerability · Source |
| CVE-2026-44695 | redhat_vex | Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity | known not affected: 1 | 2026-06-05T19:25:08+00:00 | Vulnerability · Source |
| CVE-2026-44408 | redhat_vex | Unauthorized access vulnerability in ZTE MU5250 | known not affected: 1 | 2026-06-05T19:25:08+00:00 | Vulnerability · Source |
| CVE-2026-44903 | redhat_vex | Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI | known not affected: 1 | 2026-06-05T19:25:08+00:00 | Vulnerability · Source |
| CVE-2026-44363 | redhat_vex | Unsafe remote resource fetching in expansion misp-modules | known not affected: 1 | 2026-06-05T19:25:07+00:00 | Vulnerability · Source |
| CVE-2026-44561 | redhat_vex | Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels | known not affected: 1 | 2026-06-05T19:25:06+00:00 | Vulnerability · Source |
| CVE-2026-44749 | redhat_vex | Information Disclosure vulnerability in SAP Gateway | known not affected: 1 | 2026-06-05T19:25:05+00:00 | Vulnerability · Source |
| CVE-2026-44884 | redhat_vex | Portainer: Missing authorization on custom template file endpoint exposes template content | known not affected: 1 | 2026-06-05T19:25:04+00:00 | Vulnerability · Source |
| CVE-2026-44776 | redhat_vex | Kavita: IDOR in /api/Download/* | known not affected: 1 | 2026-06-05T19:25:04+00:00 | Vulnerability · Source |
| CVE-2026-44301 | redhat_vex | Hugo: Node tool execution allows file system access outside the project directory | known not affected: 1 | 2026-06-05T19:25:03+00:00 | Vulnerability · Source |
| CVE-2026-44710 | redhat_vex | pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service | known not affected: 1 | 2026-06-05T19:25:02+00:00 | Vulnerability · Source |