VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298675 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-40355 | microsoft_vex | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message. | fixed: 2 known affected: 3 | 2026-06-03T01:43:19+00:00 | Vulnerability · Source |
| CVE-2026-41526 | microsoft_vex | In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection. | fixed: 2 known affected: 3 | 2026-06-03T01:43:10+00:00 | Vulnerability · Source |
| CVE-2026-42009 | microsoft_vex | Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | fixed: 2 known affected: 2 | 2026-06-03T01:42:52+00:00 | Vulnerability · Source |
| CVE-2026-25541 | microsoft_vex | Bytes is vulnerable to integer overflow in BytesMut::reserve | fixed: 3 known affected: 3 | 2026-06-03T01:42:45+00:00 | Vulnerability · Source |
| CVE-2026-41607 | microsoft_vex | Apache Thrift: C++ JSON OOB read | known affected: 3 | 2026-06-03T01:42:36+00:00 | Vulnerability · Source |
| CVE-2026-41606 | microsoft_vex | Apache Thrift: c_glib dispatch stack overflow | known affected: 3 | 2026-06-03T01:42:29+00:00 | Vulnerability · Source |
| CVE-2025-1176 | microsoft_vex | GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow | fixed: 8 known affected: 8 | 2026-06-03T01:42:29+00:00 | Vulnerability · Source |
| CVE-2026-6357 | microsoft_vex | pip self-update functionality can import newly installed modules after wheel installation | fixed: 4 known affected: 6 known not affected: 2 | 2026-06-03T01:42:21+00:00 | Vulnerability · Source |
| CVE-2025-1178 | microsoft_vex | GNU Binutils ld libbfd.c bfd_putl64 memory corruption | fixed: 6 known affected: 6 | 2026-06-03T01:42:20+00:00 | Vulnerability · Source |
| CVE-2025-3198 | microsoft_vex | GNU Binutils objdump bucomm.c display_info memory leak | fixed: 2 known affected: 2 | 2026-06-03T01:42:12+00:00 | Vulnerability · Source |
| CVE-2025-46394 | microsoft_vex | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. | known affected: 12 | 2026-06-03T01:41:57+00:00 | Vulnerability · Source |
| CVE-2026-8368 | microsoft_vex | LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects | fixed: 1 known affected: 1 | 2026-06-03T01:41:56+00:00 | Vulnerability · Source |
| CVE-2024-58251 | microsoft_vex | In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim. | known affected: 12 | 2026-06-03T01:41:47+00:00 | Vulnerability · Source |
| CVE-2026-43968 | microsoft_vex | CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 | fixed: 2 known affected: 2 | 2026-06-03T01:41:43+00:00 | Vulnerability · Source |
| CVE-2026-7790 | microsoft_vex | Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS | fixed: 2 known affected: 2 | 2026-06-03T01:41:35+00:00 | Vulnerability · Source |
| CVE-2026-40225 | microsoft_vex | In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. | fixed: 2 known affected: 4 | 2026-06-03T01:41:19+00:00 | Vulnerability · Source |
| CVE-2026-34956 | microsoft_vex | Openvswitch: open vswitch: denial of service via malformed ftp epasv command | fixed: 2 known affected: 2 | 2026-06-03T01:41:11+00:00 | Vulnerability · Source |
| CVE-2026-42010 | microsoft_vex | Gnutls: gnutls: authentication bypass via nul character in username | fixed: 2 known affected: 2 | 2026-06-03T01:41:01+00:00 | Vulnerability · Source |
| CVE-2026-4890 | microsoft_vex | CVE-2026-4890 | fixed: 2 known affected: 2 | 2026-06-03T01:40:53+00:00 | Vulnerability · Source |
| CVE-2026-5172 | microsoft_vex | CVE-2026-5172 | fixed: 2 known affected: 2 | 2026-06-03T01:40:44+00:00 | Vulnerability · Source |
| CVE-2026-2291 | microsoft_vex | CVE-2026-2291 | fixed: 2 known affected: 2 | 2026-06-03T01:40:36+00:00 | Vulnerability · Source |
| CVE-2026-4893 | microsoft_vex | CVE-2026-4893 | fixed: 2 known affected: 2 | 2026-06-03T01:40:28+00:00 | Vulnerability · Source |
| CVE-2026-4891 | microsoft_vex | CVE-2026-4891 | fixed: 2 known affected: 2 | 2026-06-03T01:40:20+00:00 | Vulnerability · Source |
| CVE-2026-42304 | microsoft_vex | Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains | fixed: 2 known affected: 2 | 2026-06-03T01:40:11+00:00 | Vulnerability · Source |
| CVE-2026-7168 | microsoft_vex | cross-proxy Digest auth state leak | fixed: 2 known affected: 2 known not affected: 5 | 2026-06-03T01:40:02+00:00 | Vulnerability · Source |
| CVE-2026-1502 | microsoft_vex | HTTP client proxy tunnel headers not validated for CR/LF | fixed: 2 known affected: 3 known not affected: 1 | 2026-06-03T01:39:41+00:00 | Vulnerability · Source |
| CVE-2020-8561 | microsoft_vex | Webhook redirect in kube-apiserver | fixed: 1 known affected: 2 | 2026-06-03T01:02:13+00:00 | Vulnerability · Source |
| CVE-2021-25740 | microsoft_vex | Holes in EndpointSlice Validation Enable Host Network Hijack | known affected: 1 | 2026-06-03T01:02:08+00:00 | Vulnerability · Source |
| CVE-2026-9098 | redhat_vex | CVE-2026-9098 | known not affected: 1 | 2026-06-02T22:03:32+00:00 | Vulnerability · Source |
| CVE-2026-9097 | redhat_vex | CVE-2026-9097 | known not affected: 1 | 2026-06-02T22:03:31+00:00 | Vulnerability · Source |
| CVE-2026-9094 | redhat_vex | CVE-2026-9094 | known not affected: 1 | 2026-06-02T22:03:30+00:00 | Vulnerability · Source |
| CVE-2026-9096 | redhat_vex | CVE-2026-9096 | known not affected: 1 | 2026-06-02T22:03:30+00:00 | Vulnerability · Source |
| CVE-2026-9093 | redhat_vex | CVE-2026-9093 | known not affected: 1 | 2026-06-02T22:03:28+00:00 | Vulnerability · Source |
| CVE-2026-49298 | redhat_vex | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments | known not affected: 1 | 2026-06-02T22:03:26+00:00 | Vulnerability · Source |
| CVE-2026-49267 | redhat_vex | Apache Airflow: No certificate validation on SMTP STARTTLS connections | known not affected: 1 | 2026-06-02T22:03:21+00:00 | Vulnerability · Source |
| CVE-2026-48726 | redhat_vex | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path | known not affected: 1 | 2026-06-02T22:03:18+00:00 | Vulnerability · Source |
| CVE-2026-46764 | redhat_vex | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | known not affected: 1 | 2026-06-02T22:03:16+00:00 | Vulnerability · Source |
| CVE-2026-45360 | redhat_vex | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | known not affected: 1 | 2026-06-02T22:03:14+00:00 | Vulnerability · Source |
| CVE-2026-42358 | redhat_vex | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | known not affected: 1 | 2026-06-02T22:03:13+00:00 | Vulnerability · Source |
| CVE-2026-42252 | redhat_vex | Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern | known not affected: 1 | 2026-06-02T22:03:11+00:00 | Vulnerability · Source |
| CVE-2026-41084 | redhat_vex | Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation | known not affected: 1 | 2026-06-02T22:03:03+00:00 | Vulnerability · Source |
| CVE-2026-41017 | redhat_vex | Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy | known not affected: 1 | 2026-06-02T22:03:02+00:00 | Vulnerability · Source |
| CVE-2026-41014 | redhat_vex | Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints | known not affected: 1 | 2026-06-02T22:03:02+00:00 | Vulnerability · Source |
| CVE-2026-40861 | redhat_vex | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | known not affected: 1 | 2026-06-02T22:03:01+00:00 | Vulnerability · Source |
| CVE-2026-40961 | redhat_vex | Apache Airflow: Open Redirect Bypass Vulnerability | known not affected: 1 | 2026-06-02T22:03:01+00:00 | Vulnerability · Source |
| CVE-2026-37235 | redhat_vex | CVE-2026-37235 | known not affected: 1 | 2026-06-02T22:02:58+00:00 | Vulnerability · Source |
| CVE-2026-32684 | redhat_vex | CVE-2026-32684 | known not affected: 1 | 2026-06-02T22:02:57+00:00 | Vulnerability · Source |
| CVE-2026-10286 | redhat_vex | CodeAstro Payroll System home_employee.php sql injection | known not affected: 1 | 2026-06-02T22:02:49+00:00 | Vulnerability · Source |
| CVE-2026-0088 | redhat_vex | CVE-2026-0088 | known not affected: 1 | 2026-06-02T22:02:46+00:00 | Vulnerability · Source |
| CVE-2026-0055 | redhat_vex | CVE-2026-0055 | known not affected: 1 | 2026-06-02T22:02:43+00:00 | Vulnerability · Source |