VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
291265 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2019-15601 | redhat_vex | curl: improper input validation allows users to create a 'FILE:' URL that can make the client access a remote file using SMB | known not affected: 27 | 2026-08-09T19:06:01+00:00 | Vulnerability · Source |
| CVE-2022-45143 | redhat_vex | tomcat: JsonErrorReportValve injection | fixed: 38 known affected: 48 known not affected: 9 | 2026-08-09T19:06:01+00:00 | Vulnerability · Source |
| CVE-2019-1549 | redhat_vex | openssl: information disclosure in fork() | fixed: 124 known affected: 4 known not affected: 15 | 2026-08-09T19:06:00+00:00 | Vulnerability · Source |
| CVE-2018-5730 | redhat_vex | krb5: DN container check bypass by supplying special crafted data | fixed: 117 known affected: 11 known not affected: 9 | 2026-08-09T19:05:57+00:00 | Vulnerability · Source |
| CVE-2026-15920 | redhat_vex | django: Django: Cross-site scripting via unvalidated URLField values in the admin | known affected: 47 | 2026-08-09T18:19:17+00:00 | Vulnerability · Source |
| CVE-2026-15830 | redhat_vex | django: Django: Denial of Service via parsing deeply nested geometry collections | known affected: 47 | 2026-08-09T18:07:55+00:00 | Vulnerability · Source |
| CVE-2026-15337 | redhat_vex | django: Django: Denial-of-service vulnerability due to excessive memory consumption | known affected: 47 | 2026-08-09T18:07:11+00:00 | Vulnerability · Source |
| CVE-2026-16089 | redhat_vex | keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session | known affected: 3 known not affected: 3 | 2026-08-09T16:33:04+00:00 | Vulnerability · Source |
| CVE-2026-15945 | redhat_vex | keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 | known affected: 6 | 2026-08-09T16:28:21+00:00 | Vulnerability · Source |
| CVE-2026-71437 | suse_vex | SUSE CVE CVE-2026-71437 | No product status | 2026-08-09T16:16:59+00:00 | Vulnerability · Source |
| CVE-2026-1609 | redhat_vex | org.keycloak/keycloak-quarkus-server: Keycloak: Unauthorized Access via JWT authorization grant with disabled users | known not affected: 6 | 2026-08-09T15:34:27+00:00 | Vulnerability · Source |
| CVE-2026-4948 | microsoft_vex | Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization | fixed: 2 known affected: 5 | 2026-08-09T14:49:49+00:00 | Vulnerability · Source |
| CVE-2026-41602 | microsoft_vex | Apache Thrift: Go TFramedTransport uint32 overflow | fixed: 5 known affected: 15 | 2026-08-09T14:49:43+00:00 | Vulnerability · Source |
| CVE-2026-6238 | microsoft_vex | Buffer overread in ns_printrrf with corrupted RDATA field | known affected: 5 | 2026-08-09T14:49:24+00:00 | Vulnerability · Source |
| CVE-2026-34003 | microsoft_vex | Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access | fixed: 2 known affected: 5 | 2026-08-09T14:49:16+00:00 | Vulnerability · Source |
| CVE-2026-34001 | microsoft_vex | Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption | fixed: 2 known affected: 5 | 2026-08-09T14:49:11+00:00 | Vulnerability · Source |
| CVE-2026-33999 | microsoft_vex | Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling | fixed: 2 known affected: 4 | 2026-08-09T14:49:05+00:00 | Vulnerability · Source |
| CVE-2026-5435 | microsoft_vex | Potential buffer overflow in ns_sprintrrf TSIG handling path | known affected: 5 | 2026-08-09T14:48:59+00:00 | Vulnerability · Source |
| CVE-2026-31663 | microsoft_vex | xfrm: hold dev ref until after transport_finish NF_HOOK | known affected: 11 | 2026-08-09T14:48:52+00:00 | Vulnerability · Source |
| CVE-2026-3219 | microsoft_vex | pip doesn't reject concatenated ZIP and tar archives | fixed: 4 known affected: 8 known not affected: 2 | 2026-08-09T14:48:44+00:00 | Vulnerability · Source |
| CVE-2026-5958 | microsoft_vex | Race Condition in GNU Sed | fixed: 2 known affected: 5 | 2026-08-09T14:48:38+00:00 | Vulnerability · Source |
| CVE-2026-5450 | microsoft_vex | scanf %mc off-by-one heap buffer overflow | known affected: 5 | 2026-08-09T14:48:33+00:00 | Vulnerability · Source |
| CVE-2026-5928 | microsoft_vex | Static buffer overflow in deprecated nis_local_principal | known affected: 5 | 2026-08-09T14:48:25+00:00 | Vulnerability · Source |
| CVE-2026-4786 | microsoft_vex | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | fixed: 1 known affected: 3 known not affected: 1 | 2026-08-09T14:48:18+00:00 | Vulnerability · Source |
| CVE-2026-6100 | microsoft_vex | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | fixed: 1 known affected: 3 | 2026-08-09T14:48:10+00:00 | Vulnerability · Source |
| CVE-2026-34446 | microsoft_vex | ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load | fixed: 1 known affected: 4 | 2026-08-09T14:48:03+00:00 | Vulnerability · Source |
| CVE-2026-35388 | microsoft_vex | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. | fixed: 1 known affected: 4 | 2026-08-09T14:47:52+00:00 | Vulnerability · Source |
| CVE-2026-35414 | microsoft_vex | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. | fixed: 1 known affected: 5 | 2026-08-09T14:47:46+00:00 | Vulnerability · Source |
| CVE-2026-5119 | microsoft_vex | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment | known affected: 5 | 2026-08-09T14:47:40+00:00 | Vulnerability · Source |
| CVE-2026-5201 | microsoft_vex | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image | fixed: 1 known affected: 3 | 2026-08-09T14:47:33+00:00 | Vulnerability · Source |
| CVE-2026-4046 | microsoft_vex | iconv crash due to assertion failure with untrusted input | fixed: 1 known affected: 4 | 2026-08-09T14:47:27+00:00 | Vulnerability · Source |
| CVE-2026-21710 | microsoft_vex | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | fixed: 2 known affected: 5 | 2026-08-09T14:47:22+00:00 | Vulnerability · Source |
| CVE-2026-21717 | microsoft_vex | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | fixed: 1 known affected: 5 known not affected: 1 | 2026-08-09T14:47:16+00:00 | Vulnerability · Source |
| CVE-2026-4833 | microsoft_vex | Orc discount Markdown markdown.c compile recursion | known affected: 5 | 2026-08-09T14:47:10+00:00 | Vulnerability · Source |
| CVE-2026-4647 | microsoft_vex | Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library | fixed: 6 known affected: 13 | 2026-08-09T14:47:03+00:00 | Vulnerability · Source |
| CVE-2026-3099 | microsoft_vex | Libsoup: libsoup: authentication bypass via digest authentication replay attack | known affected: 8 | 2026-08-09T14:46:51+00:00 | Vulnerability · Source |
| CVE-2026-3633 | microsoft_vex | Libsoup: libsoup: header and http request injection via crlf injection | known affected: 8 | 2026-08-09T14:46:43+00:00 | Vulnerability · Source |
| CVE-2026-3632 | microsoft_vex | Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames | known affected: 8 | 2026-08-09T14:46:36+00:00 | Vulnerability · Source |
| CVE-2026-3634 | microsoft_vex | Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header | known affected: 8 | 2026-08-09T14:46:29+00:00 | Vulnerability · Source |
| CVE-2025-69649 | microsoft_vex | GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed. | fixed: 2 known affected: 5 | 2026-08-09T14:46:13+00:00 | Vulnerability · Source |
| CVE-2025-69645 | microsoft_vex | Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file. | fixed: 2 known affected: 5 | 2026-08-09T14:46:07+00:00 | Vulnerability · Source |
| CVE-2025-69646 | microsoft_vex | Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis. | fixed: 2 known affected: 5 | 2026-08-09T14:46:01+00:00 | Vulnerability · Source |
| CVE-2025-55551 | microsoft_vex | An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation. | known affected: 15 | 2026-08-09T14:45:22+00:00 | Vulnerability · Source |
| CVE-2024-3660 | microsoft_vex | Arbitrary code injection vulnerability in Keras framework < 2.13 | known affected: 4 | 2026-08-09T14:45:09+00:00 | Vulnerability · Source |
| CVE-2023-45927 | microsoft_vex | S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf(). | known affected: 4 | 2026-08-09T14:40:53+00:00 | Vulnerability · Source |
| CVE-2026-71438 | redhat_vex | mermaid: Mermaid: Prototype pollution vulnerability via configuration APIs | known affected: 3 | 2026-08-09T07:25:12+00:00 | Vulnerability · Source |
| CVE-2026-71437 | redhat_vex | mermaid: Mermaid: Prototype pollution vulnerability allows potential arbitrary code execution | known affected: 3 | 2026-08-09T07:20:32+00:00 | Vulnerability · Source |
| CVE-2026-71852 | redhat_vex | pypdf: pypdf: Denial of Service via crafted PDF with large CID font width ranges | known affected: 14 | 2026-08-09T05:33:43+00:00 | Vulnerability · Source |
| CVE-2026-71870 | redhat_vex | pypdf: pypdf: Denial of Service via crafted PDF with large /ToUnicode streams | known affected: 14 | 2026-08-09T05:30:58+00:00 | Vulnerability · Source |
| CVE-2026-19155 | redhat_vex | chromium-browser: Chromium: Sandbox escape via use-after-free in Payments | known not affected: 1 | 2026-08-09T05:20:15+00:00 | Vulnerability · Source |