VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298659 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-48150 | redhat_vex | Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign | known not affected: 1 | 2026-06-05T19:12:55+00:00 | Vulnerability · Source |
| CVE-2026-48240 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters | known not affected: 1 | 2026-06-05T19:12:55+00:00 | Vulnerability · Source |
| CVE-2026-48527 | redhat_vex | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | known not affected: 1 | 2026-06-05T19:12:54+00:00 | Vulnerability · Source |
| CVE-2026-48239 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter | known not affected: 1 | 2026-06-05T19:12:54+00:00 | Vulnerability · Source |
| CVE-2026-48972 | redhat_vex | WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability | known not affected: 1 | 2026-06-05T19:12:53+00:00 | Vulnerability · Source |
| CVE-2026-48837 | redhat_vex | WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability | known not affected: 1 | 2026-06-05T19:12:53+00:00 | Vulnerability · Source |
| CVE-2026-48235 | redhat_vex | Open ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data | known not affected: 1 | 2026-06-05T19:12:53+00:00 | Vulnerability · Source |
| CVE-2026-39306 | redhat_vex | PraisonAI recipe registry pull path traversal writes files outside the chosen output directory | known not affected: 1 | 2026-06-05T19:12:52+00:00 | Vulnerability · Source |
| CVE-2026-39432 | redhat_vex | WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerability | known not affected: 1 | 2026-06-05T19:12:52+00:00 | Vulnerability · Source |
| CVE-2026-39414 | redhat_vex | MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing | known not affected: 1 | 2026-06-05T19:12:52+00:00 | Vulnerability · Source |
| CVE-2026-39333 | redhat_vex | ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php | known not affected: 1 | 2026-06-05T19:12:52+00:00 | Vulnerability · Source |
| CVE-2026-39531 | redhat_vex | WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability | known not affected: 1 | 2026-06-05T19:12:52+00:00 | Vulnerability · Source |
| CVE-2026-39980 | redhat_vex | OpenCTI affected by RCE via notifier template | known not affected: 1 | 2026-06-05T19:12:51+00:00 | Vulnerability · Source |
| CVE-2026-39863 | redhat_vex | Kamailio Core: TCP Data Processing Vulnerability | known not affected: 1 | 2026-06-05T19:12:51+00:00 | Vulnerability · Source |
| CVE-2026-39890 | redhat_vex | PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading | known not affected: 1 | 2026-06-05T19:12:50+00:00 | Vulnerability · Source |
| CVE-2026-39971 | redhat_vex | Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST | known not affected: 1 | 2026-06-05T19:12:50+00:00 | Vulnerability · Source |
| CVE-2026-39458 | redhat_vex | BIG-IP DNS Cache vulnerability | known not affected: 1 | 2026-06-05T19:12:50+00:00 | Vulnerability · Source |
| CVE-2026-39555 | redhat_vex | WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability | known not affected: 1 | 2026-06-05T19:12:43+00:00 | Vulnerability · Source |
| CVE-2026-39394 | redhat_vex | CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller | known not affected: 1 | 2026-06-05T19:12:42+00:00 | Vulnerability · Source |
| CVE-2026-39847 | redhat_vex | Emmett has a path traversal in internal assets handler | known not affected: 1 | 2026-06-05T19:12:42+00:00 | Vulnerability · Source |
| CVE-2026-39816 | redhat_vex | Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService | known not affected: 1 | 2026-06-05T19:12:42+00:00 | Vulnerability · Source |
| CVE-2026-39970 | redhat_vex | TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form | known not affected: 1 | 2026-06-05T19:12:41+00:00 | Vulnerability · Source |
| CVE-2026-39326 | redhat_vex | ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php | known not affected: 1 | 2026-06-05T19:12:41+00:00 | Vulnerability · Source |
| CVE-2026-39920 | redhat_vex | BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE | known not affected: 1 | 2026-06-05T19:12:41+00:00 | Vulnerability · Source |
| CVE-2026-39397 | redhat_vex | @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections | known not affected: 1 | 2026-06-05T19:12:41+00:00 | Vulnerability · Source |
| CVE-2026-39551 | redhat_vex | WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability | known not affected: 1 | 2026-06-05T19:12:40+00:00 | Vulnerability · Source |
| CVE-2026-39371 | redhat_vex | RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests | known not affected: 1 | 2026-06-05T19:12:40+00:00 | Vulnerability · Source |
| CVE-2026-39440 | redhat_vex | WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability | known not affected: 1 | 2026-06-05T19:12:40+00:00 | Vulnerability · Source |
| CVE-2026-39305 | redhat_vex | Arbitrary File Write / Path Traversal in Action Orchestrator | known not affected: 1 | 2026-06-05T19:12:38+00:00 | Vulnerability · Source |
| CVE-2026-39358 | redhat_vex | CubeCart: Time-based Blind SQL Injection | known not affected: 1 | 2026-06-05T19:12:38+00:00 | Vulnerability · Source |
| CVE-2026-39552 | redhat_vex | WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability | known not affected: 1 | 2026-06-05T19:12:36+00:00 | Vulnerability · Source |
| CVE-2026-39310 | redhat_vex | Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds | known not affected: 1 | 2026-06-05T19:12:36+00:00 | Vulnerability · Source |
| CVE-2026-39929 | redhat_vex | Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP | known not affected: 1 | 2026-06-05T19:12:36+00:00 | Vulnerability · Source |
| CVE-2026-39965 | redhat_vex | TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks | known not affected: 1 | 2026-06-05T19:12:35+00:00 | Vulnerability · Source |
| CVE-2026-39884 | redhat_vex | MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting | known not affected: 1 | 2026-06-05T19:12:35+00:00 | Vulnerability · Source |
| CVE-2026-39462 | redhat_vex | SenseLive X3050 Insufficiently Protected Credentials | known not affected: 1 | 2026-06-05T19:12:34+00:00 | Vulnerability · Source |
| CVE-2026-39330 | redhat_vex | ChurchCRM has a Blind SQL injection in PropertyAssign.php | known not affected: 1 | 2026-06-05T19:12:33+00:00 | Vulnerability · Source |
| CVE-2026-39976 | redhat_vex | Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens | known not affected: 1 | 2026-06-05T19:12:33+00:00 | Vulnerability · Source |
| CVE-2026-39327 | redhat_vex | ChurchCRM has a SQL injection in MemberRoleChange.php | known not affected: 1 | 2026-06-05T19:12:33+00:00 | Vulnerability · Source |
| CVE-2026-39312 | redhat_vex | Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition | known not affected: 1 | 2026-06-05T19:12:32+00:00 | Vulnerability · Source |
| CVE-2026-39455 | redhat_vex | BIG-IP Configuration utility vulnerability | known not affected: 1 | 2026-06-05T19:12:32+00:00 | Vulnerability · Source |
| CVE-2026-39815 | redhat_vex | CVE-2026-39815 | known not affected: 1 | 2026-06-05T19:12:32+00:00 | Vulnerability · Source |
| CVE-2026-39329 | redhat_vex | ChurchCRM has a Blind SQL injection in EventNames.php | known not affected: 1 | 2026-06-05T19:12:31+00:00 | Vulnerability · Source |
| CVE-2026-39356 | redhat_vex | SQL Injection via escapeName() in all Drizzle ORM SQL dialects | known not affected: 1 | 2026-06-05T19:12:31+00:00 | Vulnerability · Source |
| CVE-2026-39459 | redhat_vex | iControl REST and tmsh vulnerability | known not affected: 1 | 2026-06-05T19:12:31+00:00 | Vulnerability · Source |
| CVE-2026-0481 | redhat_vex | CVE-2026-0481 | known not affected: 1 | 2026-06-05T19:12:30+00:00 | Vulnerability · Source |
| CVE-2026-39891 | redhat_vex | PraisonAI has a Template Injection in Agent Tool Definitions | known not affected: 1 | 2026-06-05T19:12:30+00:00 | Vulnerability · Source |
| CVE-2026-39972 | redhat_vex | Mercure has a Topic Selector Cache Key Collision | known not affected: 1 | 2026-06-05T19:12:30+00:00 | Vulnerability · Source |
| CVE-2026-39846 | redhat_vex | SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions | known not affected: 1 | 2026-06-05T19:12:29+00:00 | Vulnerability · Source |
| CVE-2026-39387 | redhat_vex | BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter | known not affected: 1 | 2026-06-05T19:12:28+00:00 | Vulnerability · Source |