VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
299385 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2021-3856 | redhat_vex | keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader | fixed: 18 known affected: 1 | 2026-05-14T19:02:04+00:00 | Vulnerability · Source |
| CVE-2021-22137 | redhat_vex | elasticsearch: Document disclosure flaw when Document or Field Level Security is used | fixed: 2 known affected: 4 known not affected: 5 | 2026-05-14T18:58:45+00:00 | Vulnerability · Source |
| CVE-2021-22135 | redhat_vex | elasticsearch: Document disclosure flaw in the Elasticsearch suggester | fixed: 1 known affected: 5 known not affected: 5 | 2026-05-14T18:58:41+00:00 | Vulnerability · Source |
| CVE-2021-42575 | redhat_vex | owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution | fixed: 13 known not affected: 4 | 2026-05-14T18:56:28+00:00 | Vulnerability · Source |
| CVE-2021-36090 | redhat_vex | apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive | fixed: 4 known affected: 12 known not affected: 41 | 2026-05-14T18:56:00+00:00 | Vulnerability · Source |
| CVE-2021-35517 | redhat_vex | apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive | fixed: 4 known affected: 12 known not affected: 41 | 2026-05-14T18:55:59+00:00 | Vulnerability · Source |
| CVE-2021-35516 | redhat_vex | apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive | fixed: 4 known affected: 12 known not affected: 41 | 2026-05-14T18:55:55+00:00 | Vulnerability · Source |
| CVE-2021-35515 | redhat_vex | apache-commons-compress: infinite loop when reading a specially crafted 7Z archive | fixed: 4 known affected: 12 known not affected: 41 | 2026-05-14T18:55:52+00:00 | Vulnerability · Source |
| CVE-2021-33813 | redhat_vex | jdom: XXE allows attackers to cause a DoS via a crafted HTTP request | fixed: 4 known affected: 27 | 2026-05-14T18:55:51+00:00 | Vulnerability · Source |
| CVE-2021-28163 | redhat_vex | jetty: Symlink directory exposes webapp directory contents | fixed: 54 known affected: 55 known not affected: 73 | 2026-05-14T18:55:18+00:00 | Vulnerability · Source |
| CVE-2021-28164 | redhat_vex | jetty: Ambiguous paths can access WEB-INF | fixed: 39 known affected: 50 known not affected: 7 | 2026-05-14T18:55:16+00:00 | Vulnerability · Source |
| CVE-2021-21351 | redhat_vex | XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream | fixed: 6 known affected: 14 known not affected: 4 | 2026-05-14T18:54:12+00:00 | Vulnerability · Source |
| CVE-2021-3914 | redhat_vex | smallrye-health-ui: persistent cross-site scripting in endpoint | fixed: 1 | 2026-05-14T18:54:08+00:00 | Vulnerability · Source |
| CVE-2021-3827 | redhat_vex | keycloak-server-spi-private: ECP SAML binding bypasses authentication flows | fixed: 8 known affected: 1 | 2026-05-14T18:54:05+00:00 | Vulnerability · Source |
| CVE-2021-3637 | redhat_vex | keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly could lead to a DoS attack | fixed: 10 | 2026-05-14T18:53:56+00:00 | Vulnerability · Source |
| CVE-2021-3520 | redhat_vex | lz4: memory corruption due to an integer overflow bug caused by memmove argument | fixed: 47 known affected: 7 known not affected: 4 | 2026-05-14T18:53:49+00:00 | Vulnerability · Source |
| CVE-2021-21350 | redhat_vex | XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader | fixed: 18 known affected: 10 known not affected: 5 | 2026-05-14T18:52:58+00:00 | Vulnerability · Source |
| CVE-2020-25680 | redhat_vex | httpd: allow connecting via SSL to a backend worker when the backend keystore file's ID is 'unknown' | fixed: 187 | 2026-05-14T18:42:51+00:00 | Vulnerability · Source |
| CVE-2020-7020 | redhat_vex | elasticsearch: not properly preserving security permissions when executing complex queries may lead to information disclosure | fixed: 1 known affected: 3 known not affected: 3 | 2026-05-14T18:42:49+00:00 | Vulnerability · Source |
| CVE-2020-1950 | redhat_vex | tika: excessive memory usage in PSDParser | fixed: 1 known affected: 11 | 2026-05-14T18:42:35+00:00 | Vulnerability · Source |
| CVE-2018-18405 | redhat_vex | jquery: crafted onerror attribute of an IMG element could result in XSS | known affected: 1 known not affected: 323 | 2026-05-14T18:42:29+00:00 | Vulnerability · Source |
| CVE-2019-10247 | redhat_vex | jetty: error path information disclosure | fixed: 3 known affected: 78 | 2026-05-14T18:42:06+00:00 | Vulnerability · Source |
| CVE-2019-3797 | redhat_vex | spring-data-jpa: Additional information exposure with Spring Data JPA derived queries | fixed: 1 | 2026-05-14T18:41:47+00:00 | Vulnerability · Source |
| CVE-2019-3795 | redhat_vex | spring-security-core: Insecure randomness when using a secureRandom instance constructed by Spring Security | known affected: 4 known not affected: 4 | 2026-05-14T18:41:45+00:00 | Vulnerability · Source |
| CVE-2018-8017 | redhat_vex | tika: infinite loop in the IptcAnpaParser | known affected: 11 known not affected: 2 | 2026-05-14T18:41:10+00:00 | Vulnerability · Source |
| CVE-2018-12536 | redhat_vex | jetty: full server path revealed when using the default Error Handling | fixed: 1 known affected: 75 known not affected: 2 | 2026-05-14T18:41:01+00:00 | Vulnerability · Source |
| CVE-2018-11802 | redhat_vex | solr: Information disclosure via Rule-base Authorization plugin | known affected: 6 known not affected: 3 | 2026-05-14T18:40:58+00:00 | Vulnerability · Source |
| CVE-2017-15298 | redhat_vex | git: Mishandling layers of tree objects | known affected: 56 | 2026-05-14T18:40:18+00:00 | Vulnerability · Source |
| CVE-2017-11462 | redhat_vex | krb5: Automatic sec context deletion could lead to double-free | known affected: 20 | 2026-05-14T18:40:15+00:00 | Vulnerability · Source |
| CVE-2017-8872 | redhat_vex | libxml2: Out-of-bounds read in htmlParseTryOrFinish | known affected: 15 | 2026-05-14T18:40:05+00:00 | Vulnerability · Source |
| CVE-2016-9063 | redhat_vex | firefox: Possible integer overflow to fix inside XML_Parse in Expat | known affected: 21 known not affected: 18 | 2026-05-14T18:39:45+00:00 | Vulnerability · Source |
| CVE-2016-0755 | redhat_vex | curl: NTLM credentials not-checked for proxy connection re-use | known affected: 10 known not affected: 4 | 2026-05-14T18:38:51+00:00 | Vulnerability · Source |
| CVE-2015-8317 | redhat_vex | libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration | fixed: 481 known affected: 2 | 2026-05-14T18:38:34+00:00 | Vulnerability · Source |
| CVE-2015-8242 | redhat_vex | libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode | fixed: 481 known affected: 2 | 2026-05-14T18:38:30+00:00 | Vulnerability · Source |
| CVE-2015-8241 | redhat_vex | libxml2: Buffer overread with XML parser in xmlNextChar | fixed: 481 known affected: 2 | 2026-05-14T18:38:27+00:00 | Vulnerability · Source |
| CVE-2015-7941 | redhat_vex | libxml2: Out-of-bounds memory access | fixed: 481 known affected: 3 | 2026-05-14T18:38:25+00:00 | Vulnerability · Source |
| CVE-2021-28165 | redhat_vex | jetty: Resource exhaustion when receiving an invalid large TLS frame | fixed: 54 known affected: 55 known not affected: 73 | 2026-05-14T18:35:53+00:00 | Vulnerability · Source |
| CVE-2021-27568 | redhat_vex | json-smart: uncaught exception may lead to crash or information disclosure | fixed: 5 known affected: 8 known not affected: 3 | 2026-05-14T18:35:51+00:00 | Vulnerability · Source |
| CVE-2021-22132 | redhat_vex | elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure | fixed: 2 known affected: 4 known not affected: 4 | 2026-05-14T18:35:39+00:00 | Vulnerability · Source |
| CVE-2021-21349 | redhat_vex | XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host | fixed: 6 known affected: 14 known not affected: 4 | 2026-05-14T18:35:37+00:00 | Vulnerability · Source |
| CVE-2021-21348 | redhat_vex | XStream: ReDoS vulnerability | fixed: 6 known affected: 14 known not affected: 4 | 2026-05-14T18:35:34+00:00 | Vulnerability · Source |
| CVE-2021-21343 | redhat_vex | XStream: arbitrary file deletion on the local host via crafted input stream | fixed: 6 known affected: 14 known not affected: 4 | 2026-05-14T18:35:32+00:00 | Vulnerability · Source |
| CVE-2021-21342 | redhat_vex | XStream: SSRF via crafted input stream | fixed: 6 known affected: 14 known not affected: 4 | 2026-05-14T18:35:29+00:00 | Vulnerability · Source |
| CVE-2021-21341 | redhat_vex | XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream | fixed: 6 known affected: 14 known not affected: 4 | 2026-05-14T18:35:27+00:00 | Vulnerability · Source |
| CVE-2020-26259 | redhat_vex | XStream: arbitrary file deletion on the local host when unmarshalling | fixed: 6 known affected: 13 known not affected: 4 | 2026-05-14T18:34:26+00:00 | Vulnerability · Source |
| CVE-2020-26258 | redhat_vex | XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling | fixed: 6 known affected: 13 known not affected: 4 | 2026-05-14T18:34:24+00:00 | Vulnerability · Source |
| CVE-2021-29505 | redhat_vex | XStream: remote command execution attack by manipulating the processed input stream | fixed: 18 known affected: 10 known not affected: 4 | 2026-05-14T18:31:15+00:00 | Vulnerability · Source |
| CVE-2021-21347 | redhat_vex | XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator | fixed: 18 known affected: 10 known not affected: 5 | 2026-05-14T18:31:13+00:00 | Vulnerability · Source |
| CVE-2021-21346 | redhat_vex | XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue | fixed: 18 known affected: 11 known not affected: 4 | 2026-05-14T18:31:08+00:00 | Vulnerability · Source |
| CVE-2021-21345 | redhat_vex | XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry | fixed: 18 known affected: 10 known not affected: 5 | 2026-05-14T18:31:07+00:00 | Vulnerability · Source |