VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298659 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-44648 | redhat_vex | SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover | known not affected: 1 | 2026-06-05T19:11:34+00:00 | Vulnerability · Source |
| CVE-2026-44468 | redhat_vex | Incorrect Default Permissions in CODESYS Development System | known not affected: 1 | 2026-06-05T19:11:34+00:00 | Vulnerability · Source |
| CVE-2026-44657 | redhat_vex | MantisBT: Stored XSS in File Download | known not affected: 1 | 2026-06-05T19:11:33+00:00 | Vulnerability · Source |
| CVE-2026-44594 | redhat_vex | esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files | known not affected: 1 | 2026-06-05T19:11:33+00:00 | Vulnerability · Source |
| CVE-2026-44411 | redhat_vex | CVE-2026-44411 | known not affected: 1 | 2026-06-05T19:11:33+00:00 | Vulnerability · Source |
| CVE-2026-44321 | redhat_vex | free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) | known not affected: 1 | 2026-06-05T19:11:32+00:00 | Vulnerability · Source |
| CVE-2026-44330 | redhat_vex | free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions | known not affected: 1 | 2026-06-05T19:11:32+00:00 | Vulnerability · Source |
| CVE-2026-44499 | redhat_vex | ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning | known not affected: 1 | 2026-06-05T19:11:31+00:00 | Vulnerability · Source |
| CVE-2026-44680 | redhat_vex | MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys | known not affected: 1 | 2026-06-05T19:11:31+00:00 | Vulnerability · Source |
| CVE-2026-44895 | redhat_vex | GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools | known not affected: 1 | 2026-06-05T19:11:31+00:00 | Vulnerability · Source |
| CVE-2026-44482 | redhat_vex | soundcloud-rpc: Remote Code Execution via XSS in Track Title | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44905 | redhat_vex | Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44338 | redhat_vex | PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44590 | redhat_vex | Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44446 | redhat_vex | ERPNext: Possibility of SQL Injection due to missing validation | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44554 | redhat_vex | Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44635 | redhat_vex | Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-44671 | redhat_vex | ZITADEL: LDAP Filter Injection in Login Flow | known not affected: 1 | 2026-06-05T19:11:30+00:00 | Vulnerability · Source |
| CVE-2026-8203 | redhat_vex | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | known not affected: 1 | 2026-06-05T19:11:27+00:00 | Vulnerability · Source |
| CVE-2026-8670 | redhat_vex | Insecure session handling on metrics web server | known not affected: 1 | 2026-06-05T19:11:27+00:00 | Vulnerability · Source |
| CVE-2026-8076 | redhat_vex | Weak credentials vulnerability in the CashDro 3 web administration panel | known not affected: 1 | 2026-06-05T19:11:26+00:00 | Vulnerability · Source |
| CVE-2026-8832 | redhat_vex | WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost | known not affected: 1 | 2026-06-05T19:11:26+00:00 | Vulnerability · Source |
| CVE-2026-8175 | redhat_vex | Multiple vulnerabilities in Aspera applications. | known not affected: 1 | 2026-06-05T19:11:25+00:00 | Vulnerability · Source |
| CVE-2026-8931 | redhat_vex | Critical RCE vulnerability in Disig Web Signer | known not affected: 1 | 2026-06-05T19:11:24+00:00 | Vulnerability · Source |
| CVE-2026-8850 | redhat_vex | IBM HTTP Server is affected by multiple vulnerabilities | known not affected: 1 | 2026-06-05T19:11:24+00:00 | Vulnerability · Source |
| CVE-2026-8760 | redhat_vex | Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force | known not affected: 1 | 2026-06-05T19:11:23+00:00 | Vulnerability · Source |
| CVE-2026-8140 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller | known not affected: 1 | 2026-06-05T19:11:23+00:00 | Vulnerability · Source |
| CVE-2026-8364 | redhat_vex | Gladinet Triofox Missing Authentication for Critical Functions | known not affected: 1 | 2026-06-05T19:11:23+00:00 | Vulnerability · Source |
| CVE-2026-8072 | redhat_vex | Insecure generation of SAT access credentials in Ingecon EMS Board | known not affected: 1 | 2026-06-05T19:11:22+00:00 | Vulnerability · Source |
| CVE-2026-8711 | redhat_vex | NGINX JavaScript vulnerability | known not affected: 1 | 2026-06-05T19:11:21+00:00 | Vulnerability · Source |
| CVE-2026-8054 | redhat_vex | Unauthenticated SQL Injection in dotCMS Publish Audit API | known not affected: 1 | 2026-06-05T19:11:18+00:00 | Vulnerability · Source |
| CVE-2026-8135 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller. | known not affected: 1 | 2026-06-05T19:11:17+00:00 | Vulnerability · Source |
| CVE-2026-8063 | redhat_vex | Post-auth null pointer dereference when aggregating against a view with empty search pipeline | known not affected: 1 | 2026-06-05T19:11:16+00:00 | Vulnerability · Source |
| CVE-2026-8621 | redhat_vex | Crabbox < v0.12.0 Authentication Bypass via Header Spoofing | known not affected: 1 | 2026-06-05T19:11:14+00:00 | Vulnerability · Source |
| CVE-2026-8108 | redhat_vex | Fuji Electric Tellus Exposed Dangerous Method or Function | known not affected: 1 | 2026-06-05T19:11:12+00:00 | Vulnerability · Source |
| CVE-2026-8979 | redhat_vex | Authentication Bypass | known not affected: 1 | 2026-06-05T19:11:10+00:00 | Vulnerability · Source |
| CVE-2026-8603 | redhat_vex | Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR | known not affected: 1 | 2026-06-05T19:11:09+00:00 | Vulnerability · Source |
| CVE-2026-8360 | redhat_vex | Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS | known not affected: 1 | 2026-06-05T19:11:08+00:00 | Vulnerability · Source |
| CVE-2026-8629 | redhat_vex | Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints | known not affected: 1 | 2026-06-05T19:11:07+00:00 | Vulnerability · Source |
| CVE-2026-8162 | redhat_vex | multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing | known not affected: 1 | 2026-06-05T19:11:07+00:00 | Vulnerability · Source |
| CVE-2026-8980 | redhat_vex | Privilege Escalation | known not affected: 1 | 2026-06-05T19:11:05+00:00 | Vulnerability · Source |
| CVE-2026-8827 | redhat_vex | SQL Injection in extension "Address List" (tt_address) | known not affected: 1 | 2026-06-05T19:11:04+00:00 | Vulnerability · Source |
| CVE-2026-8809 | redhat_vex | Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter | known not affected: 1 | 2026-06-05T19:11:03+00:00 | Vulnerability · Source |
| CVE-2026-8854 | redhat_vex | IBM HTTP Server is affected by multiple vulnerabilities | known not affected: 1 | 2026-06-05T19:11:03+00:00 | Vulnerability · Source |
| CVE-2026-8179 | redhat_vex | Multiple vulnerabilities in Aspera applications. | known not affected: 1 | 2026-06-05T19:11:01+00:00 | Vulnerability · Source |
| CVE-2026-8890 | redhat_vex | code100x Mobile API Authentication Bypass via Header Spoofing | known not affected: 1 | 2026-06-05T19:11:01+00:00 | Vulnerability · Source |
| CVE-2026-8197 | redhat_vex | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name | known not affected: 1 | 2026-06-05T19:11:00+00:00 | Vulnerability · Source |
| CVE-2026-8137 | redhat_vex | Totolink X5000R formDdns sub_458E40 buffer overflow | known not affected: 1 | 2026-06-05T19:11:00+00:00 | Vulnerability · Source |
| CVE-2026-8359 | redhat_vex | Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS | known not affected: 1 | 2026-06-05T19:11:00+00:00 | Vulnerability · Source |
| CVE-2026-8047 | redhat_vex | Out-of-bounds Write in CODESYS Control | known not affected: 1 | 2026-06-05T19:10:59+00:00 | Vulnerability · Source |