VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298678 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-45043 | redhat_vex | RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root | known not affected: 1 | 2026-06-02T04:02:43+00:00 | Vulnerability · Source |
| CVE-2026-44697 | redhat_vex | Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload | known not affected: 1 | 2026-06-02T04:02:43+00:00 | Vulnerability · Source |
| CVE-2026-44649 | redhat_vex | SillyTavern: Authentication Bypass via SSO Header Injection | known not affected: 1 | 2026-06-02T04:02:42+00:00 | Vulnerability · Source |
| CVE-2026-10164 | redhat_vex | Edimax BR-6478AC POST Request formUSBFolder buffer overflow | known not affected: 1 | 2026-06-02T04:02:42+00:00 | Vulnerability · Source |
| CVE-2026-10179 | redhat_vex | TRENDnet TEW-432BRP formSetWlanEncrypt stack-based overflow | known not affected: 1 | 2026-06-02T04:02:42+00:00 | Vulnerability · Source |
| CVE-2026-10121 | redhat_vex | TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow | known not affected: 1 | 2026-06-02T04:02:41+00:00 | Vulnerability · Source |
| CVE-2026-10105 | redhat_vex | agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata() | known not affected: 1 | 2026-06-02T04:02:41+00:00 | Vulnerability · Source |
| CVE-2026-10069 | redhat_vex | Shibby Tomato miniupnpd resource consumption | known not affected: 1 | 2026-06-02T04:02:41+00:00 | Vulnerability · Source |
| CVE-2026-10163 | redhat_vex | Edimax BR-6478AC POST Request formUSBAccount buffer overflow | known not affected: 1 | 2026-06-02T04:02:41+00:00 | Vulnerability · Source |
| CVE-2026-25833 | microsoft_vex | Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function | known not affected: 2 | 2026-06-02T01:48:24+00:00 | Vulnerability · Source |
| CVE-2026-34873 | microsoft_vex | An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session. | known not affected: 2 | 2026-06-02T01:48:09+00:00 | Vulnerability · Source |
| CVE-2026-34874 | microsoft_vex | An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0. | known not affected: 2 | 2026-06-02T01:48:03+00:00 | Vulnerability · Source |
| CVE-2025-15504 | microsoft_vex | lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereference | known affected: 1 known not affected: 2 | 2026-06-02T01:47:58+00:00 | Vulnerability · Source |
| CVE-2026-2673 | microsoft_vex | OpenSSL TLS 1.3 server may choose unexpected key agreement group | fixed: 1 known affected: 3 known not affected: 5 | 2026-06-02T01:47:52+00:00 | Vulnerability · Source |
| CVE-2026-34875 | microsoft_vex | An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0. A buffer overflow can occur in public key export for FFDH keys. | known not affected: 2 | 2026-06-02T01:47:47+00:00 | Vulnerability · Source |
| CVE-2026-34871 | microsoft_vex | An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG). | known not affected: 2 | 2026-06-02T01:47:42+00:00 | Vulnerability · Source |
| CVE-2026-21711 | microsoft_vex | A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature. | known affected: 3 known not affected: 1 | 2026-06-02T01:47:37+00:00 | Vulnerability · Source |
| CVE-2026-33671 | microsoft_vex | Picomatch has a ReDoS vulnerability via extglob quantifiers | fixed: 1 known affected: 2 known not affected: 4 | 2026-06-02T01:47:26+00:00 | Vulnerability · Source |
| CVE-2026-33672 | microsoft_vex | Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching | fixed: 1 known affected: 2 known not affected: 4 | 2026-06-02T01:47:14+00:00 | Vulnerability · Source |
| CVE-2026-34872 | microsoft_vex | An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values (lack of contributory behavior). This is a problem for protocols that depend on contributory behavior (which is not the case for TLS). The attack can be carried by the peer, or depending on the protocol by an active network attacker (person in the middle). | known not affected: 2 | 2026-06-02T01:47:07+00:00 | Vulnerability · Source |
| CVE-2026-31789 | microsoft_vex | Heap Buffer Overflow in Hexadecimal Conversion | fixed: 1 known affected: 5 known not affected: 7 | 2026-06-02T01:47:02+00:00 | Vulnerability · Source |
| CVE-2017-3736 | microsoft_vex | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. | known affected: 12 known not affected: 10 | 2026-06-02T01:46:51+00:00 | Vulnerability · Source |
| CVE-2026-41184 | microsoft_vex | ServiceAccount token disclosure via install-cni container logs | known not affected: 1 | 2026-06-02T01:46:04+00:00 | Vulnerability · Source |
| CVE-2026-9538 | microsoft_vex | Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header | known not affected: 1 | 2026-06-02T01:45:58+00:00 | Vulnerability · Source |
| CVE-2026-46157 | microsoft_vex | ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger | known not affected: 1 | 2026-06-02T01:45:48+00:00 | Vulnerability · Source |
| CVE-2026-46235 | microsoft_vex | media: saa7164: add ioremap return checks and cleanups | known not affected: 1 | 2026-06-02T01:45:43+00:00 | Vulnerability · Source |
| CVE-2026-46179 | microsoft_vex | ASoC: SOF: Don't allow pointer operations on unconfigured streams | known not affected: 1 | 2026-06-02T01:45:38+00:00 | Vulnerability · Source |
| CVE-2026-46232 | microsoft_vex | HID: playstation: Clamp num_touch_reports | known not affected: 1 | 2026-06-02T01:45:32+00:00 | Vulnerability · Source |
| CVE-2026-7259 | microsoft_vex | Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() | fixed: 1 known affected: 1 | 2026-06-02T01:45:31+00:00 | Vulnerability · Source |
| CVE-2026-46194 | microsoft_vex | f2fs: fix node_cnt race between extent node destroy and writeback | known not affected: 1 | 2026-06-02T01:45:27+00:00 | Vulnerability · Source |
| CVE-2026-7568 | microsoft_vex | Signed integer overflow in metaphone() | fixed: 1 known affected: 1 | 2026-06-02T01:45:26+00:00 | Vulnerability · Source |
| CVE-2026-46148 | microsoft_vex | spi: microchip-core-qspi: control built-in cs manually | known not affected: 1 | 2026-06-02T01:45:21+00:00 | Vulnerability · Source |
| CVE-2025-14179 | microsoft_vex | SQL injection in pdo_firebird via NUL bytes in quoted strings | fixed: 1 known affected: 1 | 2026-06-02T01:45:20+00:00 | Vulnerability · Source |
| CVE-2026-46184 | microsoft_vex | sound: ua101: fix division by zero at probe | known not affected: 1 | 2026-06-02T01:45:15+00:00 | Vulnerability · Source |
| CVE-2026-7262 | microsoft_vex | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | fixed: 1 known affected: 1 | 2026-06-02T01:45:14+00:00 | Vulnerability · Source |
| CVE-2026-46121 | microsoft_vex | mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock | known not affected: 1 | 2026-06-02T01:45:10+00:00 | Vulnerability · Source |
| CVE-2026-6735 | microsoft_vex | XSS within PHP-FPM status endpoint | fixed: 1 known affected: 1 | 2026-06-02T01:45:08+00:00 | Vulnerability · Source |
| CVE-2026-46169 | microsoft_vex | hfsplus: fix uninit-value by validating catalog record size | known not affected: 1 | 2026-06-02T01:45:04+00:00 | Vulnerability · Source |
| CVE-2026-6722 | microsoft_vex | Use-After-Free in SOAP using Apache map | fixed: 1 known affected: 1 | 2026-06-02T01:45:03+00:00 | Vulnerability · Source |
| CVE-2026-6324 | suse_vex | SUSE CVE CVE-2026-6324 | known affected: 184 | 2026-06-02T01:45:01+00:00 | Vulnerability · Source |
| CVE-2026-46143 | microsoft_vex | ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens | known not affected: 1 | 2026-06-02T01:44:58+00:00 | Vulnerability · Source |
| CVE-2026-7258 | microsoft_vex | Out-of-bounds read in urldecode() on NetBSD | fixed: 1 known affected: 1 | 2026-06-02T01:44:57+00:00 | Vulnerability · Source |
| CVE-2026-8796 | suse_vex | SUSE CVE CVE-2026-8796 | recommended: 1 | 2026-06-02T01:44:57+00:00 | Vulnerability · Source |
| CVE-2026-10194 | suse_vex | SUSE CVE CVE-2026-10194 | No product status | 2026-06-02T01:44:56+00:00 | Vulnerability · Source |
| CVE-2026-10198 | suse_vex | SUSE CVE CVE-2026-10198 | known affected: 5 | 2026-06-02T01:44:54+00:00 | Vulnerability · Source |
| CVE-2026-47104 | microsoft_vex | libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array() | known not affected: 2 | 2026-06-02T01:44:53+00:00 | Vulnerability · Source |
| CVE-2026-7261 | microsoft_vex | SoapServer session-persisted object use-after-free via SOAP header fault | fixed: 1 known affected: 1 | 2026-06-02T01:44:52+00:00 | Vulnerability · Source |
| CVE-2026-10201 | suse_vex | SUSE CVE CVE-2026-10201 | known affected: 5 | 2026-06-02T01:44:51+00:00 | Vulnerability · Source |
| CVE-2026-10229 | suse_vex | SUSE CVE CVE-2026-10229 | known affected: 533 | 2026-06-02T01:44:50+00:00 | Vulnerability · Source |
| CVE-2026-10230 | suse_vex | SUSE CVE CVE-2026-10230 | known affected: 533 | 2026-06-02T01:44:48+00:00 | Vulnerability · Source |