VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298613 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-41905 | redhat_vex | FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access | known not affected: 1 | 2026-06-05T19:20:53+00:00 | Vulnerability · Source |
| CVE-2026-41068 | redhat_vex | Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) | known not affected: 1 | 2026-06-05T19:20:53+00:00 | Vulnerability · Source |
| CVE-2026-41231 | redhat_vex | Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron | known not affected: 1 | 2026-06-05T19:20:52+00:00 | Vulnerability · Source |
| CVE-2026-41589 | redhat_vex | Wish has SCP Path Traversal that allows arbitrary file read/write | known not affected: 1 | 2026-06-05T19:20:52+00:00 | Vulnerability · Source |
| CVE-2026-41886 | redhat_vex | locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor | known not affected: 1 | 2026-06-05T19:20:52+00:00 | Vulnerability · Source |
| CVE-2026-41501 | redhat_vex | electerm has Command Injection Vulnerability via runLinux function | known not affected: 1 | 2026-06-05T19:20:51+00:00 | Vulnerability · Source |
| CVE-2026-41060 | redhat_vex | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | known not affected: 1 | 2026-06-05T19:20:51+00:00 | Vulnerability · Source |
| CVE-2026-41217 | redhat_vex | BIG-IP tmsh vulnerability | known not affected: 1 | 2026-06-05T19:20:51+00:00 | Vulnerability · Source |
| CVE-2026-41679 | redhat_vex | Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass | known not affected: 1 | 2026-06-05T19:20:51+00:00 | Vulnerability · Source |
| CVE-2026-41303 | redhat_vex | OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands | known not affected: 1 | 2026-06-05T19:20:50+00:00 | Vulnerability · Source |
| CVE-2026-41334 | redhat_vex | OpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass | known not affected: 1 | 2026-06-05T19:20:49+00:00 | Vulnerability · Source |
| CVE-2026-41172 | redhat_vex | Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets) | known not affected: 1 | 2026-06-05T19:20:49+00:00 | Vulnerability · Source |
| CVE-2026-41859 | redhat_vex | CVE-2026-41859 | known not affected: 1 | 2026-06-05T19:20:49+00:00 | Vulnerability · Source |
| CVE-2026-41055 | redhat_vex | AVideo has an incomplete fix for CVE-2026-33039 (SSRF) | known not affected: 1 | 2026-06-05T19:20:48+00:00 | Vulnerability · Source |
| CVE-2026-41712 | redhat_vex | ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage | known not affected: 1 | 2026-06-05T19:20:47+00:00 | Vulnerability · Source |
| CVE-2026-41235 | redhat_vex | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement | known not affected: 1 | 2026-06-05T19:20:47+00:00 | Vulnerability · Source |
| CVE-2026-41433 | redhat_vex | OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR | known not affected: 1 | 2026-06-05T19:20:46+00:00 | Vulnerability · Source |
| CVE-2026-41190 | redhat_vex | FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection | known not affected: 1 | 2026-06-05T19:20:46+00:00 | Vulnerability · Source |
| CVE-2026-41352 | redhat_vex | OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass | known not affected: 1 | 2026-06-05T19:20:46+00:00 | Vulnerability · Source |
| CVE-2026-41271 | redhat_vex | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | known not affected: 1 | 2026-06-05T19:20:46+00:00 | Vulnerability · Source |
| CVE-2026-41037 | redhat_vex | Missing Rate Limiting Vulnerability in Quantum Networks Router QN-I-470 | known not affected: 1 | 2026-06-05T19:20:45+00:00 | Vulnerability · Source |
| CVE-2026-41145 | redhat_vex | MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads | known not affected: 1 | 2026-06-05T19:20:44+00:00 | Vulnerability · Source |
| CVE-2026-41208 | redhat_vex | Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution | known not affected: 1 | 2026-06-05T19:20:44+00:00 | Vulnerability · Source |
| CVE-2026-41640 | redhat_vex | NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading | known not affected: 1 | 2026-06-05T19:20:44+00:00 | Vulnerability · Source |
| CVE-2026-41064 | redhat_vex | AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) | known not affected: 1 | 2026-06-05T19:20:44+00:00 | Vulnerability · Source |
| CVE-2026-41325 | redhat_vex | Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection | known not affected: 1 | 2026-06-05T19:20:44+00:00 | Vulnerability · Source |
| CVE-2026-41486 | redhat_vex | Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization | known not affected: 1 | 2026-06-05T19:20:43+00:00 | Vulnerability · Source |
| CVE-2026-41505 | redhat_vex | RELATE: Predictable Token Generation in auth.py and exam.py | known not affected: 1 | 2026-06-05T19:20:43+00:00 | Vulnerability · Source |
| CVE-2026-41882 | redhat_vex | CVE-2026-41882 | known not affected: 1 | 2026-06-05T19:20:43+00:00 | Vulnerability · Source |
| CVE-2026-41288 | redhat_vex | WatchGuard Agent on Windows Privilege Escalation Vulnerability | known not affected: 1 | 2026-06-05T19:20:42+00:00 | Vulnerability · Source |
| CVE-2026-41369 | redhat_vex | OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution | known not affected: 1 | 2026-06-05T19:20:42+00:00 | Vulnerability · Source |
| CVE-2026-41011 | redhat_vex | CVE-2026-41011 | known not affected: 1 | 2026-06-05T19:20:42+00:00 | Vulnerability · Source |
| CVE-2026-41189 | redhat_vex | FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads | known not affected: 1 | 2026-06-05T19:20:41+00:00 | Vulnerability · Source |
| CVE-2026-41468 | redhat_vex | Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection | known not affected: 1 | 2026-06-05T19:20:41+00:00 | Vulnerability · Source |
| CVE-2026-41200 | redhat_vex | STIG Manager has reflected XSS vulnerability in the Web App | known not affected: 1 | 2026-06-05T19:20:41+00:00 | Vulnerability · Source |
| CVE-2026-41279 | redhat_vex | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials | known not affected: 1 | 2026-06-05T19:20:40+00:00 | Vulnerability · Source |
| CVE-2026-41267 | redhat_vex | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association | known not affected: 1 | 2026-06-05T19:20:40+00:00 | Vulnerability · Source |
| CVE-2026-41951 | redhat_vex | CVE-2026-41951 | known not affected: 1 | 2026-06-05T19:20:39+00:00 | Vulnerability · Source |
| CVE-2026-41294 | redhat_vex | OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File | known not affected: 1 | 2026-06-05T19:20:39+00:00 | Vulnerability · Source |
| CVE-2026-41690 | redhat_vex | Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters | known not affected: 1 | 2026-06-05T19:20:38+00:00 | Vulnerability · Source |
| CVE-2026-41276 | redhat_vex | Flowise: AccountService resetPassword Authentication Bypass Vulnerability | known not affected: 1 | 2026-06-05T19:20:38+00:00 | Vulnerability · Source |
| CVE-2026-41492 | redhat_vex | Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph | known not affected: 1 | 2026-06-05T19:20:36+00:00 | Vulnerability · Source |
| CVE-2026-41375 | redhat_vex | OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints | known not affected: 1 | 2026-06-05T19:20:36+00:00 | Vulnerability · Source |
| CVE-2026-41258 | redhat_vex | OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange | known not affected: 1 | 2026-06-05T19:20:36+00:00 | Vulnerability · Source |
| CVE-2026-41241 | redhat_vex | pretalx: Stored cross-site scripting in organiser search typeahead | known not affected: 1 | 2026-06-05T19:20:36+00:00 | Vulnerability · Source |
| CVE-2026-41304 | redhat_vex | WWBN AVideo vulnerable to RCE caused by clonesite plugin | known not affected: 1 | 2026-06-05T19:20:35+00:00 | Vulnerability · Source |
| CVE-2026-41421 | redhat_vex | SiYuan Desktop Notification XSS Leads to Electron RCE | known not affected: 1 | 2026-06-05T19:20:35+00:00 | Vulnerability · Source |
| CVE-2026-41502 | redhat_vex | BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder | known not affected: 1 | 2026-06-05T19:20:34+00:00 | Vulnerability · Source |
| CVE-2026-41070 | redhat_vex | openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access | known not affected: 1 | 2026-06-05T19:20:34+00:00 | Vulnerability · Source |
| CVE-2026-41272 | redhat_vex | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | known not affected: 1 | 2026-06-05T19:20:34+00:00 | Vulnerability · Source |