VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
301613 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-6916 | redhat_vex | Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute | known not affected: 1 | 2026-05-04T20:21:20+00:00 | Vulnerability · Source |
| CVE-2026-7593 | redhat_vex | Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection | known not affected: 1 | 2026-05-04T20:21:20+00:00 | Vulnerability · Source |
| CVE-2026-7589 | redhat_vex | ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal | known not affected: 1 | 2026-05-04T20:21:19+00:00 | Vulnerability · Source |
| CVE-2026-7579 | redhat_vex | AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials | known not affected: 1 | 2026-05-04T20:21:18+00:00 | Vulnerability · Source |
| CVE-2026-7545 | redhat_vex | SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection | known not affected: 1 | 2026-05-04T20:21:18+00:00 | Vulnerability · Source |
| CVE-2026-7549 | redhat_vex | SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injection | known not affected: 1 | 2026-05-04T20:21:18+00:00 | Vulnerability · Source |
| CVE-2026-7209 | redhat_vex | Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | known not affected: 1 | 2026-05-04T20:21:17+00:00 | Vulnerability · Source |
| CVE-2026-7443 | redhat_vex | BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection | known not affected: 1 | 2026-05-04T20:21:17+00:00 | Vulnerability · Source |
| CVE-2026-6817 | redhat_vex | Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason' | known not affected: 1 | 2026-05-04T20:21:16+00:00 | Vulnerability · Source |
| CVE-2026-7674 | redhat_vex | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflow | known not affected: 1 | 2026-05-04T20:21:16+00:00 | Vulnerability · Source |
| CVE-2026-6812 | redhat_vex | Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter | known not affected: 1 | 2026-05-04T20:21:15+00:00 | Vulnerability · Source |
| CVE-2026-6447 | redhat_vex | Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings | known not affected: 1 | 2026-05-04T20:21:15+00:00 | Vulnerability · Source |
| CVE-2026-6446 | redhat_vex | My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action | known not affected: 1 | 2026-05-04T20:21:15+00:00 | Vulnerability · Source |
| CVE-2026-6449 | redhat_vex | Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint | known not affected: 1 | 2026-05-04T20:21:15+00:00 | Vulnerability · Source |
| CVE-2026-4790 | redhat_vex | Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter | known not affected: 1 | 2026-05-04T20:21:14+00:00 | Vulnerability · Source |
| CVE-2026-6378 | redhat_vex | Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API | known not affected: 1 | 2026-05-04T20:21:14+00:00 | Vulnerability · Source |
| CVE-2026-5077 | redhat_vex | Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute | known not affected: 1 | 2026-05-04T20:21:14+00:00 | Vulnerability · Source |
| CVE-2026-4650 | redhat_vex | FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler | known not affected: 1 | 2026-05-04T20:21:13+00:00 | Vulnerability · Source |
| CVE-2026-4658 | redhat_vex | Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes | known not affected: 1 | 2026-05-04T20:21:13+00:00 | Vulnerability · Source |
| CVE-2026-7685 | redhat_vex | Edimax BR-6208AC setWAN buffer overflow | known not affected: 1 | 2026-05-04T20:21:12+00:00 | Vulnerability · Source |
| CVE-2026-3504 | redhat_vex | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint | known not affected: 1 | 2026-05-04T20:21:12+00:00 | Vulnerability · Source |
| CVE-2026-7684 | redhat_vex | Edimax BR-6428nC setWAN buffer overflow | known not affected: 1 | 2026-05-04T20:21:12+00:00 | Vulnerability · Source |
| CVE-2026-4024 | redhat_vex | Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification | known not affected: 1 | 2026-05-04T20:21:12+00:00 | Vulnerability · Source |
| CVE-2026-7641 | redhat_vex | Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields | known not affected: 1 | 2026-05-04T20:21:10+00:00 | Vulnerability · Source |
| CVE-2026-7647 | redhat_vex | Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection | known not affected: 1 | 2026-05-04T20:21:10+00:00 | Vulnerability · Source |
| CVE-2026-7489 | redhat_vex | Sunnet｜CTMS - SQL Injection | known not affected: 1 | 2026-05-04T20:21:10+00:00 | Vulnerability · Source |
| CVE-2026-7649 | redhat_vex | ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter | known not affected: 1 | 2026-05-04T20:21:10+00:00 | Vulnerability · Source |
| CVE-2026-7470 | redhat_vex | Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow | known not affected: 1 | 2026-05-04T20:21:10+00:00 | Vulnerability · Source |
| CVE-2026-7607 | redhat_vex | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflow | known not affected: 1 | 2026-05-04T20:21:09+00:00 | Vulnerability · Source |
| CVE-2026-6229 | redhat_vex | Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter | known not affected: 1 | 2026-05-04T20:21:09+00:00 | Vulnerability · Source |
| CVE-2026-7491 | redhat_vex | Zyosoft｜School App - Insecure Direct Object Reference | known not affected: 1 | 2026-05-04T20:21:08+00:00 | Vulnerability · Source |
| CVE-2026-7435 | redhat_vex | SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString | known not affected: 1 | 2026-05-04T20:21:08+00:00 | Vulnerability · Source |
| CVE-2026-7513 | redhat_vex | UTT HiPER 1200GW formRemoteControl strcpy buffer overflow | known not affected: 1 | 2026-05-04T20:21:08+00:00 | Vulnerability · Source |
| CVE-2026-7490 | redhat_vex | Sunnet｜CTMS and CPAS - Arbitrary File Upload | known not affected: 1 | 2026-05-04T20:21:07+00:00 | Vulnerability · Source |
| CVE-2026-7503 | redhat_vex | code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow | known not affected: 1 | 2026-05-04T20:21:07+00:00 | Vulnerability · Source |
| CVE-2026-5324 | redhat_vex | Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value | known not affected: 1 | 2026-05-04T20:21:07+00:00 | Vulnerability · Source |
| CVE-2026-7458 | redhat_vex | User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint | known not affected: 1 | 2026-05-04T20:21:06+00:00 | Vulnerability · Source |
| CVE-2026-7049 | redhat_vex | PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter | known not affected: 1 | 2026-05-04T20:21:05+00:00 | Vulnerability · Source |
| CVE-2026-6963 | redhat_vex | WP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Action | known not affected: 1 | 2026-05-04T20:21:05+00:00 | Vulnerability · Source |
| CVE-2026-6320 | redhat_vex | Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal | known not affected: 1 | 2026-05-04T20:21:05+00:00 | Vulnerability · Source |
| CVE-2026-5111 | redhat_vex | Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater | known not affected: 1 | 2026-05-04T20:21:04+00:00 | Vulnerability · Source |
| CVE-2026-5113 | redhat_vex | Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input | known not affected: 1 | 2026-05-04T20:21:04+00:00 | Vulnerability · Source |
| CVE-2026-5112 | redhat_vex | Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater | known not affected: 1 | 2026-05-04T20:21:04+00:00 | Vulnerability · Source |
| CVE-2026-5110 | redhat_vex | Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater | known not affected: 1 | 2026-05-04T20:21:04+00:00 | Vulnerability · Source |
| CVE-2026-5063 | redhat_vex | NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names | known not affected: 1 | 2026-05-04T20:21:03+00:00 | Vulnerability · Source |
| CVE-2026-4100 | redhat_vex | Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption | known not affected: 1 | 2026-05-04T20:21:03+00:00 | Vulnerability · Source |
| CVE-2026-4060 | redhat_vex | Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter | known not affected: 1 | 2026-05-04T20:21:03+00:00 | Vulnerability · Source |
| CVE-2026-5109 | redhat_vex | Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option | known not affected: 1 | 2026-05-04T20:21:03+00:00 | Vulnerability · Source |
| CVE-2026-4882 | redhat_vex | User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload | known not affected: 1 | 2026-05-04T20:21:03+00:00 | Vulnerability · Source |
| CVE-2026-4061 | redhat_vex | Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter | known not affected: 1 | 2026-05-04T20:21:03+00:00 | Vulnerability · Source |