VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
291221 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2023-37460 | redhat_vex | plexus-archiver: Arbitrary File Creation in AbstractUnArchiver | fixed: 13 known affected: 7 known not affected: 21 | 2026-08-08T18:21:22+00:00 | Vulnerability · Source |
| CVE-2023-20883 | redhat_vex | spring-boot: Spring Boot Welcome Page DoS Vulnerability | fixed: 5 known affected: 13 known not affected: 10 | 2026-08-08T18:21:20+00:00 | Vulnerability · Source |
| CVE-2023-20873 | redhat_vex | spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry | fixed: 3 known affected: 5 known not affected: 21 | 2026-08-08T18:21:17+00:00 | Vulnerability · Source |
| CVE-2022-29599 | redhat_vex | maven-shared-utils: Command injection via Commandline class | fixed: 521 known affected: 7 known not affected: 61 | 2026-08-08T18:21:16+00:00 | Vulnerability · Source |
| CVE-2022-25845 | redhat_vex | fastjson: autoType shutdown restriction bypass leads to deserialization | fixed: 1 known affected: 3 known not affected: 1 | 2026-08-08T18:21:14+00:00 | Vulnerability · Source |
| CVE-2021-39144 | redhat_vex | xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* | fixed: 19 known affected: 9 known not affected: 19 | 2026-08-08T18:21:06+00:00 | Vulnerability · Source |
| CVE-2020-36188 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:21:03+00:00 | Vulnerability · Source |
| CVE-2020-36187 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:21:02+00:00 | Vulnerability · Source |
| CVE-2020-36185 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:59+00:00 | Vulnerability · Source |
| CVE-2020-36186 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:59+00:00 | Vulnerability · Source |
| CVE-2020-36182 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:57+00:00 | Vulnerability · Source |
| CVE-2020-36183 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:55+00:00 | Vulnerability · Source |
| CVE-2020-36181 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:50+00:00 | Vulnerability · Source |
| CVE-2020-36180 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:48+00:00 | Vulnerability · Source |
| CVE-2020-36179 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:47+00:00 | Vulnerability · Source |
| CVE-2020-35728 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool | fixed: 6 known affected: 11 known not affected: 175 | 2026-08-08T18:20:44+00:00 | Vulnerability · Source |
| CVE-2020-24750 | redhat_vex | jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration | fixed: 22 known affected: 10 known not affected: 300 | 2026-08-08T18:20:40+00:00 | Vulnerability · Source |
| CVE-2020-35491 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource | fixed: 6 known affected: 12 known not affected: 172 | 2026-08-08T18:20:40+00:00 | Vulnerability · Source |
| CVE-2020-35490 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource | fixed: 6 known affected: 12 known not affected: 172 | 2026-08-08T18:20:38+00:00 | Vulnerability · Source |
| CVE-2020-24616 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource | known affected: 16 known not affected: 18 | 2026-08-08T18:20:35+00:00 | Vulnerability · Source |
| CVE-2020-14062 | redhat_vex | jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool | fixed: 1349 known affected: 19 known not affected: 9 | 2026-08-08T18:20:31+00:00 | Vulnerability · Source |
| CVE-2020-14061 | redhat_vex | jackson-databind: serialization in weblogic/oracle-aqjms | fixed: 1349 known affected: 19 known not affected: 9 | 2026-08-08T18:20:30+00:00 | Vulnerability · Source |
| CVE-2020-14060 | redhat_vex | jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool | fixed: 98 known affected: 19 known not affected: 9 | 2026-08-08T18:20:26+00:00 | Vulnerability · Source |
| CVE-2020-10673 | redhat_vex | jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution | fixed: 791 known affected: 13 known not affected: 20 | 2026-08-08T18:20:23+00:00 | Vulnerability · Source |
| CVE-2019-17571 | redhat_vex | log4j: deserialization of untrusted data in SocketServer | fixed: 119 known affected: 3 known not affected: 32 | 2026-08-08T18:20:21+00:00 | Vulnerability · Source |
| CVE-2018-17196 | redhat_vex | kafka: potential to bypass transaction/idempotent ACL checks | known affected: 1 known not affected: 4 | 2026-08-08T18:20:20+00:00 | Vulnerability · Source |
| CVE-2019-9515 | redhat_vex | HTTP/2: flood using SETTINGS frames results in unbounded memory growth | fixed: 706 known affected: 12 known not affected: 115 | 2026-08-08T18:20:18+00:00 | Vulnerability · Source |
| CVE-2019-0201 | redhat_vex | zookeeper: Information disclosure in Apache ZooKeeper | fixed: 3 known affected: 3 known not affected: 2 | 2026-08-08T18:20:17+00:00 | Vulnerability · Source |
| CVE-2018-8088 | redhat_vex | slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution | fixed: 760 known affected: 11 known not affected: 38 under investigation: 2 | 2026-08-08T18:20:09+00:00 | Vulnerability · Source |
| CVE-2018-8012 | redhat_vex | zookeeper: No authentication or authorization is enforced when a server joins a quorum | known affected: 2 known not affected: 8 | 2026-08-08T18:20:08+00:00 | Vulnerability · Source |
| CVE-2018-1131 | redhat_vex | infinispan: deserialization of data in XML and JSON transcoders | fixed: 2 known affected: 5 known not affected: 3 | 2026-08-08T18:20:05+00:00 | Vulnerability · Source |
| CVE-2021-24033 | redhat_vex | nodejs-react-dev-utils: function getProcessForPort concatenates input argument into a command string | known affected: 2 known not affected: 15 | 2026-08-08T18:02:23+00:00 | Vulnerability · Source |
| CVE-2024-21490 | redhat_vex | angular: Inefficient Regular Expression Complexity | known affected: 5 known not affected: 62 | 2026-08-08T18:01:31+00:00 | Vulnerability · Source |
| CVE-2022-46663 | redhat_vex | less: crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal | fixed: 13 known affected: 1 known not affected: 21 | 2026-08-08T18:01:27+00:00 | Vulnerability · Source |
| CVE-2022-29167 | redhat_vex | hawk: REDoS in hawk.utils.parseHost() when parsing Host header | known affected: 40 known not affected: 43 | 2026-08-08T18:01:18+00:00 | Vulnerability · Source |
| CVE-2012-6153 | redhat_vex | CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix | fixed: 123 known affected: 27 known not affected: 44 | 2026-08-08T17:20:05+00:00 | Vulnerability · Source |
| CVE-2021-33194 | redhat_vex | golang: x/net/html: infinite loop in ParseFragment | fixed: 13 known affected: 75 known not affected: 990 | 2026-08-08T17:17:48+00:00 | Vulnerability · Source |
| CVE-2020-13822 | redhat_vex | nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures | fixed: 7 known affected: 9 known not affected: 243 | 2026-08-08T17:17:42+00:00 | Vulnerability · Source |
| CVE-2020-8911 | redhat_vex | aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang | fixed: 10 known affected: 6 known not affected: 86 | 2026-08-08T17:17:39+00:00 | Vulnerability · Source |
| CVE-2025-8419 | redhat_vex | org.keycloak/keycloak-services: Keycloak SMTP Inject Vulnerability | fixed: 18 | 2026-08-08T17:15:33+00:00 | Vulnerability · Source |
| CVE-2025-7962 | redhat_vex | com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability | known affected: 8 known not affected: 18 | 2026-08-08T17:15:29+00:00 | Vulnerability · Source |
| CVE-2025-7365 | redhat_vex | keycloak: Phishing attack via email verification step in first login flow | fixed: 17 | 2026-08-08T17:15:24+00:00 | Vulnerability · Source |
| CVE-2024-47535 | redhat_vex | netty: Denial of Service attack on windows app using Netty | fixed: 289 known not affected: 9 | 2026-08-08T17:15:20+00:00 | Vulnerability · Source |
| CVE-2024-34447 | redhat_vex | org.bouncycastle: Use of Incorrectly-Resolved Name or Reference | fixed: 3 known affected: 6 known not affected: 972 | 2026-08-08T17:15:14+00:00 | Vulnerability · Source |
| CVE-2024-24750 | redhat_vex | undici: memory leak | known not affected: 5 | 2026-08-08T17:14:39+00:00 | Vulnerability · Source |
| CVE-2024-10973 | redhat_vex | keycloak: CLI option for encrypted JGroups ignored | known not affected: 3 | 2026-08-08T17:14:36+00:00 | Vulnerability · Source |
| CVE-2024-9621 | redhat_vex | io.quarkiverse.cxf:quarkus-cxf: Quarkus CXF may log user password and secret to application log | fixed: 1 | 2026-08-08T17:14:32+00:00 | Vulnerability · Source |
| CVE-2024-7260 | redhat_vex | keycloak-core: Open Redirect on Account page | fixed: 8 | 2026-08-08T17:14:30+00:00 | Vulnerability · Source |
| CVE-2023-6927 | redhat_vex | keycloak: open redirect via "form_post.jwt" JARM response mode | fixed: 30 known not affected: 5 | 2026-08-08T17:14:29+00:00 | Vulnerability · Source |
| CVE-2019-19956 | redhat_vex | libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c | fixed: 225 known affected: 6 known not affected: 1 | 2026-08-08T17:14:22+00:00 | Vulnerability · Source |