VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298629 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-45158 | redhat_vex | OPNsense: Command Injection via Attacker-Controlled DHCP Config | known not affected: 1 | 2026-06-05T19:18:07+00:00 | Vulnerability · Source |
| CVE-2026-45716 | redhat_vex | Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration | known not affected: 1 | 2026-06-05T19:18:07+00:00 | Vulnerability · Source |
| CVE-2026-45209 | redhat_vex | WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:18:06+00:00 | Vulnerability · Source |
| CVE-2026-45083 | redhat_vex | Goobi viewer: Unauthenticated Solr Streaming Expression Proxy | known not affected: 1 | 2026-06-05T19:18:06+00:00 | Vulnerability · Source |
| CVE-2026-45353 | redhat_vex | electerm: Local code through electerm's single-instance socket | known not affected: 1 | 2026-06-05T19:18:05+00:00 | Vulnerability · Source |
| CVE-2026-45722 | redhat_vex | Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views | known not affected: 1 | 2026-06-05T19:18:05+00:00 | Vulnerability · Source |
| CVE-2026-45663 | redhat_vex | Dokploy: Remote Code Execution via destinationPath in Container File Upload | known not affected: 1 | 2026-06-05T19:18:05+00:00 | Vulnerability · Source |
| CVE-2026-45298 | redhat_vex | Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) | known not affected: 1 | 2026-06-05T19:18:04+00:00 | Vulnerability · Source |
| CVE-2026-45137 | redhat_vex | Anchor: Program<'info, System> is not properly validated | known not affected: 1 | 2026-06-05T19:18:04+00:00 | Vulnerability · Source |
| CVE-2026-45322 | redhat_vex | OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON | known not affected: 1 | 2026-06-05T19:18:04+00:00 | Vulnerability · Source |
| CVE-2026-45087 | redhat_vex | Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode | known not affected: 1 | 2026-06-05T19:18:04+00:00 | Vulnerability · Source |
| CVE-2026-45218 | redhat_vex | WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability | known not affected: 1 | 2026-06-05T19:18:04+00:00 | Vulnerability · Source |
| CVE-2026-45685 | redhat_vex | OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages | known not affected: 1 | 2026-06-05T19:18:04+00:00 | Vulnerability · Source |
| CVE-2026-45430 | redhat_vex | CVE-2026-45430 | known not affected: 1 | 2026-06-05T19:18:03+00:00 | Vulnerability · Source |
| CVE-2026-45223 | redhat_vex | Crabbox < 0.9.0 Authentication Bypass via Admin Claim Injection | known not affected: 1 | 2026-06-05T19:18:03+00:00 | Vulnerability · Source |
| CVE-2026-45214 | redhat_vex | WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability | known not affected: 1 | 2026-06-05T19:18:02+00:00 | Vulnerability · Source |
| CVE-2026-45717 | redhat_vex | Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL. | known not affected: 1 | 2026-06-05T19:18:02+00:00 | Vulnerability · Source |
| CVE-2026-45331 | redhat_vex | Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature | known not affected: 1 | 2026-06-05T19:18:02+00:00 | Vulnerability · Source |
| CVE-2026-45555 | redhat_vex | Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution | known not affected: 1 | 2026-06-05T19:18:01+00:00 | Vulnerability · Source |
| CVE-2026-45438 | redhat_vex | WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:18:01+00:00 | Vulnerability · Source |
| CVE-2026-45627 | redhat_vex | Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover | known not affected: 1 | 2026-06-05T19:18:00+00:00 | Vulnerability · Source |
| CVE-2026-45348 | redhat_vex | pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal | known not affected: 1 | 2026-06-05T19:18:00+00:00 | Vulnerability · Source |
| CVE-2026-45108 | redhat_vex | Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow | known not affected: 1 | 2026-06-05T19:18:00+00:00 | Vulnerability · Source |
| CVE-2026-45207 | redhat_vex | CVE-2026-45207 | known not affected: 1 | 2026-06-05T19:17:59+00:00 | Vulnerability · Source |
| CVE-2026-45342 | redhat_vex | LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes | known not affected: 1 | 2026-06-05T19:17:59+00:00 | Vulnerability · Source |
| CVE-2026-45216 | redhat_vex | WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability | known not affected: 1 | 2026-06-05T19:17:58+00:00 | Vulnerability · Source |
| CVE-2026-45432 | redhat_vex | Cleartext Transmission of Credentials Vulnerability in GX Earth ONT Models | known not affected: 1 | 2026-06-05T19:17:58+00:00 | Vulnerability · Source |
| CVE-2026-6456 | redhat_vex | Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation | known not affected: 1 | 2026-06-05T19:17:58+00:00 | Vulnerability · Source |
| CVE-2026-45728 | redhat_vex | Algernon: Single-file mode unconditionally enables debug mode | known not affected: 1 | 2026-06-05T19:17:57+00:00 | Vulnerability · Source |
| CVE-2026-45539 | redhat_vex | Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree | known not affected: 1 | 2026-06-05T19:17:57+00:00 | Vulnerability · Source |
| CVE-2026-45089 | redhat_vex | Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode | known not affected: 1 | 2026-06-05T19:17:57+00:00 | Vulnerability · Source |
| CVE-2026-45399 | redhat_vex | Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption | known not affected: 1 | 2026-06-05T19:17:56+00:00 | Vulnerability · Source |
| CVE-2026-45302 | redhat_vex | Prototype Pollution in parse-nested-form-data via `__proto__` in FormData field names | known not affected: 1 | 2026-06-05T19:17:56+00:00 | Vulnerability · Source |
| CVE-2026-45364 | redhat_vex | Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation | known not affected: 1 | 2026-06-05T19:17:56+00:00 | Vulnerability · Source |
| CVE-2026-45548 | redhat_vex | Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation | known not affected: 1 | 2026-06-05T19:17:56+00:00 | Vulnerability · Source |
| CVE-2026-45678 | redhat_vex | OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads | known not affected: 1 | 2026-06-05T19:17:55+00:00 | Vulnerability · Source |
| CVE-2026-45131 | redhat_vex | CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests | known not affected: 1 | 2026-06-05T19:17:55+00:00 | Vulnerability · Source |
| CVE-2026-45715 | redhat_vex | Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration | known not affected: 1 | 2026-06-05T19:17:54+00:00 | Vulnerability · Source |
| CVE-2026-6177 | redhat_vex | Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text | known not affected: 1 | 2026-06-05T19:17:54+00:00 | Vulnerability · Source |
| CVE-2026-45230 | redhat_vex | DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file | known not affected: 1 | 2026-06-05T19:17:54+00:00 | Vulnerability · Source |
| CVE-2026-6690 | redhat_vex | LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action | known not affected: 1 | 2026-06-05T19:17:53+00:00 | Vulnerability · Source |
| CVE-2026-6348 | redhat_vex | Simopro Technology｜WinMatrix - Missing Authentication | known not affected: 1 | 2026-06-05T19:17:53+00:00 | Vulnerability · Source |
| CVE-2026-6375 | redhat_vex | Authorization bypass through User-Controlled key in SpiceJet Online Booking System | known not affected: 1 | 2026-06-05T19:17:53+00:00 | Vulnerability · Source |
| CVE-2026-6960 | redhat_vex | BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field | known not affected: 1 | 2026-06-05T19:17:52+00:00 | Vulnerability · Source |
| CVE-2026-6834 | redhat_vex | aEnrich｜a+HRD - Missing Authorization | known not affected: 1 | 2026-06-05T19:17:52+00:00 | Vulnerability · Source |
| CVE-2026-6195 | redhat_vex | Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection | known not affected: 1 | 2026-06-05T19:17:52+00:00 | Vulnerability · Source |
| CVE-2026-6016 | redhat_vex | Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow | known not affected: 1 | 2026-06-05T19:17:51+00:00 | Vulnerability · Source |
| CVE-2026-6887 | redhat_vex | BorG Technology Corporation｜Borg SPM 2007 - SQL Injection | known not affected: 1 | 2026-06-05T19:17:51+00:00 | Vulnerability · Source |
| CVE-2026-6483 | redhat_vex | Wavlink WL-WN530H4 internet.cgi snprintf os command injection | known not affected: 1 | 2026-06-05T19:17:51+00:00 | Vulnerability · Source |
| CVE-2026-6133 | redhat_vex | Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow | known not affected: 1 | 2026-06-05T19:17:51+00:00 | Vulnerability · Source |