VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298659 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-44241 | redhat_vex | Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header | known not affected: 1 | 2026-06-05T19:12:00+00:00 | Vulnerability · Source |
| CVE-2026-44403 | redhat_vex | Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization | known not affected: 1 | 2026-06-05T19:11:59+00:00 | Vulnerability · Source |
| CVE-2026-44698 | redhat_vex | Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection | known not affected: 1 | 2026-06-05T19:11:58+00:00 | Vulnerability · Source |
| CVE-2026-44700 | redhat_vex | Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake | known not affected: 1 | 2026-06-05T19:11:58+00:00 | Vulnerability · Source |
| CVE-2026-44115 | redhat_vex | OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist | known not affected: 1 | 2026-06-05T19:11:57+00:00 | Vulnerability · Source |
| CVE-2026-44340 | redhat_vex | PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir` | known not affected: 1 | 2026-06-05T19:11:57+00:00 | Vulnerability · Source |
| CVE-2026-44375 | redhat_vex | Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException | known not affected: 1 | 2026-06-05T19:11:56+00:00 | Vulnerability · Source |
| CVE-2026-44511 | redhat_vex | Katalyst Koi: Session cookies can be replayed after user logout | known not affected: 1 | 2026-06-05T19:11:56+00:00 | Vulnerability · Source |
| CVE-2026-44887 | redhat_vex | Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path) | known not affected: 1 | 2026-06-05T19:11:55+00:00 | Vulnerability · Source |
| CVE-2026-44717 | redhat_vex | MCP Calculate Server: Prompt Injection to RCE | known not affected: 1 | 2026-06-05T19:11:54+00:00 | Vulnerability · Source |
| CVE-2026-44555 | redhat_vex | Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining | known not affected: 1 | 2026-06-05T19:11:54+00:00 | Vulnerability · Source |
| CVE-2026-44672 | redhat_vex | mapfish-print: Remote Code Injection (RCE) in Dynamic table | known not affected: 1 | 2026-06-05T19:11:54+00:00 | Vulnerability · Source |
| CVE-2026-44412 | redhat_vex | CVE-2026-44412 | known not affected: 1 | 2026-06-05T19:11:54+00:00 | Vulnerability · Source |
| CVE-2026-44609 | redhat_vex | CVE-2026-44609 | known not affected: 1 | 2026-06-05T19:11:52+00:00 | Vulnerability · Source |
| CVE-2026-44483 | redhat_vex | RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data) | known not affected: 1 | 2026-06-05T19:11:52+00:00 | Vulnerability · Source |
| CVE-2026-44465 | redhat_vex | Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config | known not affected: 1 | 2026-06-05T19:11:52+00:00 | Vulnerability · Source |
| CVE-2026-44339 | redhat_vex | PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute | known not affected: 1 | 2026-06-05T19:11:52+00:00 | Vulnerability · Source |
| CVE-2026-44237 | redhat_vex | FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module | known not affected: 1 | 2026-06-05T19:11:50+00:00 | Vulnerability · Source |
| CVE-2026-44633 | redhat_vex | Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries | known not affected: 1 | 2026-06-05T19:11:50+00:00 | Vulnerability · Source |
| CVE-2026-44471 | redhat_vex | gitoxide: Symlink prefix-reuse allows worktree escape during checkout | known not affected: 1 | 2026-06-05T19:11:50+00:00 | Vulnerability · Source |
| CVE-2026-44714 | redhat_vex | bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass | known not affected: 1 | 2026-06-05T19:11:50+00:00 | Vulnerability · Source |
| CVE-2026-44381 | redhat_vex | MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings | known not affected: 1 | 2026-06-05T19:11:48+00:00 | Vulnerability · Source |
| CVE-2026-44345 | redhat_vex | BentoML: Dockerfile command injection via docker.base_image | known not affected: 1 | 2026-06-05T19:11:48+00:00 | Vulnerability · Source |
| CVE-2026-44246 | redhat_vex | nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet` | known not affected: 1 | 2026-06-05T19:11:47+00:00 | Vulnerability · Source |
| CVE-2026-44497 | redhat_vex | ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer | known not affected: 1 | 2026-06-05T19:11:46+00:00 | Vulnerability · Source |
| CVE-2026-44413 | redhat_vex | CVE-2026-44413 | known not affected: 1 | 2026-06-05T19:11:45+00:00 | Vulnerability · Source |
| CVE-2026-44888 | redhat_vex | Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger) | known not affected: 1 | 2026-06-05T19:11:45+00:00 | Vulnerability · Source |
| CVE-2026-44260 | redhat_vex | efw4.X: readonly Flag Not Enforced Server-Side | known not affected: 1 | 2026-06-05T19:11:44+00:00 | Vulnerability · Source |
| CVE-2026-44503 | redhat_vex | Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect | known not affected: 1 | 2026-06-05T19:11:44+00:00 | Vulnerability · Source |
| CVE-2026-44224 | redhat_vex | Wiki.js: Privilege Escalation via Missing Group Validation in users.update | known not affected: 1 | 2026-06-05T19:11:44+00:00 | Vulnerability · Source |
| CVE-2026-44826 | redhat_vex | Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals | known not affected: 1 | 2026-06-05T19:11:43+00:00 | Vulnerability · Source |
| CVE-2026-44798 | redhat_vex | Nautobot: GitRepository.current_head field should not be writable through REST API | known not affected: 1 | 2026-06-05T19:11:43+00:00 | Vulnerability · Source |
| CVE-2026-44521 | redhat_vex | elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) | known not affected: 1 | 2026-06-05T19:11:43+00:00 | Vulnerability · Source |
| CVE-2026-44547 | redhat_vex | ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 | known not affected: 1 | 2026-06-05T19:11:42+00:00 | Vulnerability · Source |
| CVE-2026-44334 | redhat_vex | PraisonAI: Unauthenticated RCE via `tool_override.py` | known not affected: 1 | 2026-06-05T19:11:42+00:00 | Vulnerability · Source |
| CVE-2026-44088 | redhat_vex | Remote Code Execution in SzafirHost | known not affected: 1 | 2026-06-05T19:11:42+00:00 | Vulnerability · Source |
| CVE-2026-44682 | redhat_vex | CVE-2026-44682 | known not affected: 1 | 2026-06-05T19:11:41+00:00 | Vulnerability · Source |
| CVE-2026-44655 | redhat_vex | MantisBT: Stored XSS on Move Attachments Admin Page | known not affected: 1 | 2026-06-05T19:11:41+00:00 | Vulnerability · Source |
| CVE-2026-44556 | redhat_vex | Open WebUI: responses passthrough endpoint lacks access control authorization | known not affected: 1 | 2026-06-05T19:11:40+00:00 | Vulnerability · Source |
| CVE-2026-44295 | redhat_vex | protobufjs-cli: Code injection in pbjs static output from crafted schema names | known not affected: 1 | 2026-06-05T19:11:40+00:00 | Vulnerability · Source |
| CVE-2026-44316 | redhat_vex | free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference | known not affected: 1 | 2026-06-05T19:11:39+00:00 | Vulnerability · Source |
| CVE-2026-44712 | redhat_vex | pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent | known not affected: 1 | 2026-06-05T19:11:38+00:00 | Vulnerability · Source |
| CVE-2026-44109 | redhat_vex | OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation | known not affected: 1 | 2026-06-05T19:11:37+00:00 | Vulnerability · Source |
| CVE-2026-44325 | redhat_vex | free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) | known not affected: 1 | 2026-06-05T19:11:37+00:00 | Vulnerability · Source |
| CVE-2026-44886 | redhat_vex | Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection | known not affected: 1 | 2026-06-05T19:11:36+00:00 | Vulnerability · Source |
| CVE-2026-44343 | redhat_vex | WGDashboard: Critical Vulnerability in 4.3.2 | known not affected: 1 | 2026-06-05T19:11:36+00:00 | Vulnerability · Source |
| CVE-2026-44262 | redhat_vex | Scramble: Remote code execution via evaluation of user-controlled input in validation rules | known not affected: 1 | 2026-06-05T19:11:36+00:00 | Vulnerability · Source |
| CVE-2026-44729 | redhat_vex | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | known not affected: 1 | 2026-06-05T19:11:35+00:00 | Vulnerability · Source |
| CVE-2026-44011 | redhat_vex | Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | known not affected: 1 | 2026-06-05T19:11:35+00:00 | Vulnerability · Source |
| CVE-2026-44666 | redhat_vex | HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution | known not affected: 1 | 2026-06-05T19:11:34+00:00 | Vulnerability · Source |