VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
298679 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-9364 | redhat_vex | projectworlds Online Art Gallery Shop adminHome.php sql injection | known not affected: 1 | 2026-05-28T20:13:10+00:00 | Vulnerability · Source |
| CVE-2026-46365 | redhat_vex | phpMyFAQ - Missing Authorization in Tag Deletion Endpoint | known not affected: 1 | 2026-05-28T20:13:09+00:00 | Vulnerability · Source |
| CVE-2026-46424 | redhat_vex | Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour | known not affected: 1 | 2026-05-28T20:13:09+00:00 | Vulnerability · Source |
| CVE-2026-46363 | redhat_vex | phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass | known not affected: 1 | 2026-05-28T20:13:09+00:00 | Vulnerability · Source |
| CVE-2026-45335 | redhat_vex | WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage | known not affected: 1 | 2026-05-28T20:13:08+00:00 | Vulnerability · Source |
| CVE-2026-46360 | redhat_vex | phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer | known not affected: 1 | 2026-05-28T20:13:08+00:00 | Vulnerability · Source |
| CVE-2026-45718 | redhat_vex | Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows | known not affected: 1 | 2026-05-28T20:13:08+00:00 | Vulnerability · Source |
| CVE-2026-45009 | redhat_vex | phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints | known not affected: 1 | 2026-05-28T20:13:07+00:00 | Vulnerability · Source |
| CVE-2026-44837 | redhat_vex | view_component: System Test Entry Point Path Check Allows Sibling Directory Escape | known not affected: 1 | 2026-05-28T20:13:07+00:00 | Vulnerability · Source |
| CVE-2026-45007 | redhat_vex | phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure | known not affected: 1 | 2026-05-28T20:13:07+00:00 | Vulnerability · Source |
| CVE-2026-44475 | redhat_vex | Ella Core: UE Security Capability bypass on NGAP PathSwitchRequest | known not affected: 1 | 2026-05-28T20:13:06+00:00 | Vulnerability · Source |
| CVE-2026-44443 | redhat_vex | Lumiverse: Sign-up nonce race condition allows unauthorized account registration | known not affected: 1 | 2026-05-28T20:13:05+00:00 | Vulnerability · Source |
| CVE-2026-42328 | redhat_vex | go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth | known not affected: 1 | 2026-05-28T20:13:05+00:00 | Vulnerability · Source |
| CVE-2026-44324 | redhat_vex | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) | known not affected: 1 | 2026-05-28T20:13:05+00:00 | Vulnerability · Source |
| CVE-2026-44317 | redhat_vex | free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference | known not affected: 1 | 2026-05-28T20:13:04+00:00 | Vulnerability · Source |
| CVE-2026-42877 | redhat_vex | FacturaScripts: Stored XSS via product reference in sales/purchases | known not affected: 1 | 2026-05-28T20:13:03+00:00 | Vulnerability · Source |
| CVE-2026-42878 | redhat_vex | FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts | known not affected: 1 | 2026-05-28T20:13:03+00:00 | Vulnerability · Source |
| CVE-2026-48544 | redhat_vex | Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource() | known not affected: 1 | 2026-05-28T20:13:01+00:00 | Vulnerability · Source |
| CVE-2026-9482 | redhat_vex | Edimax EW-7438RPn formSDHCP stack-based overflow | known not affected: 1 | 2026-05-28T20:13:01+00:00 | Vulnerability · Source |
| CVE-2026-9632 | redhat_vex | UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow | known not affected: 1 | 2026-05-28T20:13:01+00:00 | Vulnerability · Source |
| CVE-2026-9476 | redhat_vex | Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection | known not affected: 1 | 2026-05-28T20:13:00+00:00 | Vulnerability · Source |
| CVE-2026-9458 | redhat_vex | Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection | known not affected: 1 | 2026-05-28T20:13:00+00:00 | Vulnerability · Source |
| CVE-2026-9434 | redhat_vex | Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection | known not affected: 1 | 2026-05-28T20:12:59+00:00 | Vulnerability · Source |
| CVE-2026-48146 | redhat_vex | Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection | known not affected: 1 | 2026-05-28T20:12:59+00:00 | Vulnerability · Source |
| CVE-2026-9428 | redhat_vex | Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow | known not affected: 1 | 2026-05-28T20:12:59+00:00 | Vulnerability · Source |
| CVE-2026-8180 | redhat_vex | Multiple vulnerabilities in Aspera applications. | known not affected: 1 | 2026-05-28T20:12:58+00:00 | Vulnerability · Source |
| CVE-2026-49046 | redhat_vex | WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability | known not affected: 1 | 2026-05-28T20:12:58+00:00 | Vulnerability · Source |
| CVE-2026-48149 | redhat_vex | Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass | known not affected: 1 | 2026-05-28T20:12:57+00:00 | Vulnerability · Source |
| CVE-2026-48151 | redhat_vex | Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema | known not affected: 1 | 2026-05-28T20:12:57+00:00 | Vulnerability · Source |
| CVE-2026-47118 | redhat_vex | Agent Zero < 1.15 Path Traversal File Read via image_get API | known not affected: 1 | 2026-05-28T20:12:56+00:00 | Vulnerability · Source |
| CVE-2026-46425 | redhat_vex | Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users | known not affected: 1 | 2026-05-28T20:12:55+00:00 | Vulnerability · Source |
| CVE-2026-46427 | redhat_vex | Budibase: Snowflake private key returned unmasked from datasource API to BASIC users | known not affected: 1 | 2026-05-28T20:12:55+00:00 | Vulnerability · Source |
| CVE-2026-46367 | redhat_vex | phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering | known not affected: 1 | 2026-05-28T20:12:54+00:00 | Vulnerability · Source |
| CVE-2026-46366 | redhat_vex | phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass | known not affected: 1 | 2026-05-28T20:12:53+00:00 | Vulnerability · Source |
| CVE-2026-46364 | redhat_vex | phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha | known not affected: 1 | 2026-05-28T20:12:52+00:00 | Vulnerability · Source |
| CVE-2026-46361 | redhat_vex | phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig | known not affected: 1 | 2026-05-28T20:12:52+00:00 | Vulnerability · Source |
| CVE-2026-46359 | redhat_vex | phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields | known not affected: 1 | 2026-05-28T20:12:51+00:00 | Vulnerability · Source |
| CVE-2026-45061 | redhat_vex | Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) | known not affected: 1 | 2026-05-28T20:12:51+00:00 | Vulnerability · Source |
| CVE-2026-45575 | redhat_vex | epa4all-client: Improper Verification of Cryptographic Signature | known not affected: 1 | 2026-05-28T20:12:51+00:00 | Vulnerability · Source |
| CVE-2026-45010 | redhat_vex | phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint | known not affected: 1 | 2026-05-28T20:12:50+00:00 | Vulnerability · Source |
| CVE-2026-44985 | redhat_vex | Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication | known not affected: 1 | 2026-05-28T20:12:50+00:00 | Vulnerability · Source |
| CVE-2026-45090 | redhat_vex | Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode) | known not affected: 1 | 2026-05-28T20:12:50+00:00 | Vulnerability · Source |
| CVE-2026-44900 | redhat_vex | epa4all-client: VAU Signature bypass | known not affected: 1 | 2026-05-28T20:12:49+00:00 | Vulnerability · Source |
| CVE-2026-44473 | redhat_vex | Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse | known not affected: 1 | 2026-05-28T20:12:49+00:00 | Vulnerability · Source |
| CVE-2026-44460 | redhat_vex | FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret | known not affected: 1 | 2026-05-28T20:12:49+00:00 | Vulnerability · Source |
| CVE-2026-44346 | redhat_vex | BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml | known not affected: 1 | 2026-05-28T20:12:48+00:00 | Vulnerability · Source |
| CVE-2026-44327 | redhat_vex | free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler | known not affected: 1 | 2026-05-28T20:12:48+00:00 | Vulnerability · Source |
| CVE-2026-44329 | redhat_vex | free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers | known not affected: 1 | 2026-05-28T20:12:48+00:00 | Vulnerability · Source |
| CVE-2026-40034 | redhat_vex | gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule | known not affected: 1 | 2026-05-28T20:12:47+00:00 | Vulnerability · Source |
| CVE-2026-44322 | redhat_vex | free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference | known not affected: 1 | 2026-05-28T20:12:47+00:00 | Vulnerability · Source |