VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298659 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-40600 | redhat_vex | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id | known not affected: 1 | 2026-06-05T19:13:15+00:00 | Vulnerability · Source |
| CVE-2026-40589 | redhat_vex | FreeScout has Customer Edit Cross-Mailbox Email Takeover | known not affected: 1 | 2026-06-05T19:13:15+00:00 | Vulnerability · Source |
| CVE-2026-40172 | redhat_vex | authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser | known not affected: 1 | 2026-06-05T19:13:14+00:00 | Vulnerability · Source |
| CVE-2026-40811 | redhat_vex | Unauthenticated SQLi in ssoabstractservice | known not affected: 1 | 2026-06-05T19:13:14+00:00 | Vulnerability · Source |
| CVE-2026-40060 | redhat_vex | BIG-IP Advanced WAF and ASM vulnerability | known not affected: 1 | 2026-06-05T19:13:14+00:00 | Vulnerability · Source |
| CVE-2026-40154 | redhat_vex | PraisonAI Affected by Untrusted Remote Template Code Execution | known not affected: 1 | 2026-06-05T19:13:13+00:00 | Vulnerability · Source |
| CVE-2026-40325 | redhat_vex | Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content | known not affected: 1 | 2026-06-05T19:13:13+00:00 | Vulnerability · Source |
| CVE-2026-40631 | redhat_vex | BIG-IP iControl SOAP vulnerability | known not affected: 1 | 2026-06-05T19:13:13+00:00 | Vulnerability · Source |
| CVE-2026-40604 | redhat_vex | ClearanceKit: opfilter system extension can be suspended or signalled by a root process, disabling file-access policy enforcement | known not affected: 1 | 2026-06-05T19:13:12+00:00 | Vulnerability · Source |
| CVE-2026-40901 | redhat_vex | DataEase: Quartz Deserialization → Remote Code Execution | known not affected: 1 | 2026-06-05T19:13:12+00:00 | Vulnerability · Source |
| CVE-2026-40514 | redhat_vex | SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG | known not affected: 1 | 2026-06-05T19:13:12+00:00 | Vulnerability · Source |
| CVE-2026-40288 | redhat_vex | PraisonAI: Critical RCE via `type: job` workflow YAML | known not affected: 1 | 2026-06-05T19:13:11+00:00 | Vulnerability · Source |
| CVE-2026-40882 | redhat_vex | OpenRemote has XXE in Velbus Asset Import | known not affected: 1 | 2026-06-05T19:13:11+00:00 | Vulnerability · Source |
| CVE-2026-40945 | redhat_vex | Oxia: Bearer token exposed in debug log messages on authentication failure | known not affected: 1 | 2026-06-05T19:13:10+00:00 | Vulnerability · Source |
| CVE-2026-40846 | redhat_vex | Authenticated SQLi in system view | known not affected: 1 | 2026-06-05T19:13:10+00:00 | Vulnerability · Source |
| CVE-2026-40909 | redhat_vex | WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) | known not affected: 1 | 2026-06-05T19:13:09+00:00 | Vulnerability · Source |
| CVE-2026-40585 | redhat_vex | blueprintUE: Password Reset Tokens Have No Expiry Window | known not affected: 1 | 2026-06-05T19:13:09+00:00 | Vulnerability · Source |
| CVE-2026-40828 | redhat_vex | Authenticated SQLi in DeleteSysLogEntry function | known not affected: 1 | 2026-06-05T19:13:09+00:00 | Vulnerability · Source |
| CVE-2026-40873 | redhat_vex | mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames | known not affected: 1 | 2026-06-05T19:13:08+00:00 | Vulnerability · Source |
| CVE-2026-40459 | redhat_vex | LDAP Injection in PAC4J | known not affected: 1 | 2026-06-05T19:13:07+00:00 | Vulnerability · Source |
| CVE-2026-40837 | redhat_vex | Authenticated SQLi in getProjectScalings function | known not affected: 1 | 2026-06-05T19:13:07+00:00 | Vulnerability · Source |
| CVE-2026-40819 | redhat_vex | Unauthenticated SQLi in sync_data24 task | known not affected: 1 | 2026-06-05T19:13:06+00:00 | Vulnerability · Source |
| CVE-2026-40576 | redhat_vex | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server | known not affected: 1 | 2026-06-05T19:13:06+00:00 | Vulnerability · Source |
| CVE-2026-48027 | redhat_vex | Compromised Nx Console version 18.95.0 | known not affected: 1 | 2026-06-05T19:13:05+00:00 | Vulnerability · Source |
| CVE-2026-48898 | redhat_vex | Joomla! Core - [20260513] - Privilege escalation through com_users batch task | known not affected: 1 | 2026-06-05T19:13:05+00:00 | Vulnerability · Source |
| CVE-2026-48896 | redhat_vex | Joomla! Core - [20260511] - MFA Authentication Bypass | known not affected: 1 | 2026-06-05T19:13:05+00:00 | Vulnerability · Source |
| CVE-2026-48126 | redhat_vex | Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir | known not affected: 1 | 2026-06-05T19:13:05+00:00 | Vulnerability · Source |
| CVE-2026-48234 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters | known not affected: 1 | 2026-06-05T19:13:04+00:00 | Vulnerability · Source |
| CVE-2026-48241 | redhat_vex | Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php | known not affected: 1 | 2026-06-05T19:13:04+00:00 | Vulnerability · Source |
| CVE-2026-48153 | redhat_vex | Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata | known not affected: 1 | 2026-06-05T19:13:04+00:00 | Vulnerability · Source |
| CVE-2026-48188 | redhat_vex | SQL Injection via MySQL Quote Method | known not affected: 1 | 2026-06-05T19:13:04+00:00 | Vulnerability · Source |
| CVE-2026-48557 | redhat_vex | Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php | known not affected: 1 | 2026-06-05T19:13:04+00:00 | Vulnerability · Source |
| CVE-2026-48131 | redhat_vex | VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero | known not affected: 1 | 2026-06-05T19:13:03+00:00 | Vulnerability · Source |
| CVE-2026-48904 | redhat_vex | Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints | known not affected: 1 | 2026-06-05T19:13:02+00:00 | Vulnerability · Source |
| CVE-2026-48238 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter | known not affected: 1 | 2026-06-05T19:13:02+00:00 | Vulnerability · Source |
| CVE-2026-48247 | redhat_vex | Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php | known not affected: 1 | 2026-06-05T19:13:02+00:00 | Vulnerability · Source |
| CVE-2026-48865 | redhat_vex | WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability | known not affected: 1 | 2026-06-05T19:13:02+00:00 | Vulnerability · Source |
| CVE-2026-48232 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter | known not affected: 1 | 2026-06-05T19:13:01+00:00 | Vulnerability · Source |
| CVE-2026-48152 | redhat_vex | Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL | known not affected: 1 | 2026-06-05T19:13:00+00:00 | Vulnerability · Source |
| CVE-2026-48233 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter | known not affected: 1 | 2026-06-05T19:13:00+00:00 | Vulnerability · Source |
| CVE-2026-48209 | redhat_vex | Reflected XSS in authenticated agent context | known not affected: 1 | 2026-06-05T19:13:00+00:00 | Vulnerability · Source |
| CVE-2026-48862 | redhat_vex | Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency | known not affected: 1 | 2026-06-05T19:12:59+00:00 | Vulnerability · Source |
| CVE-2026-48897 | redhat_vex | Joomla! Core - [20260512] - MFA Authentication Bypass | known not affected: 1 | 2026-06-05T19:12:59+00:00 | Vulnerability · Source |
| CVE-2026-48879 | redhat_vex | WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability | known not affected: 1 | 2026-06-05T19:12:59+00:00 | Vulnerability · Source |
| CVE-2026-48545 | redhat_vex | Gradio < 6.15.0 Cookie Injection via Shared Proxy Client | known not affected: 1 | 2026-06-05T19:12:58+00:00 | Vulnerability · Source |
| CVE-2026-48866 | redhat_vex | WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability | known not affected: 1 | 2026-06-05T19:12:58+00:00 | Vulnerability · Source |
| CVE-2026-48839 | redhat_vex | WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability | known not affected: 1 | 2026-06-05T19:12:57+00:00 | Vulnerability · Source |
| CVE-2026-48246 | redhat_vex | Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php | known not affected: 1 | 2026-06-05T19:12:57+00:00 | Vulnerability · Source |
| CVE-2026-48237 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters | known not affected: 1 | 2026-06-05T19:12:56+00:00 | Vulnerability · Source |
| CVE-2026-48231 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters | known not affected: 1 | 2026-06-05T19:12:55+00:00 | Vulnerability · Source |