Update VEX status files to where we are today, June 2026

[epugh]

Many of the vex entries have open ended verisons like "x.x-today", that made sense when first written, but time has passed.

Leveraging some AI support, and some manual poking I went and update the "today" to which specific of version of Solr is actually impacted by the vulnerablity.

I eliminated the tika core entry, it was VERY vague, and I couldn't map it any real CVE. The other velocity tools entry I tied it to the underlying struts cves that are what was triggering the vulnerablity.

[epugh]

@ppkarwasz would love a review

[Copilot]

Pull request overview

This PR updates Solr VEX (Vulnerability Exploitability eXchange) markdown entries to replace open-ended “today/present” version ranges with concrete Solr version bounds as of June 2026, and removes/reworks a couple of overly vague dependency notes.

Changes:

• Replace open-ended versions: values across many VEX entries with bounded ranges (e.g., …-8.x, ≤ 9.0, etc.).
• Remove the old tika-core and velocity-tools catch-all entries; introduce a new Struts-1/velocity-tools transitive-dependency VEX note tied to specific CVEs.
• Add/extend explanatory text in a couple of entries to justify the revised affected-version bounds.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
content/solr/vex/2025-07-25-cve-2024-51504.md	Normalizes the affected Solr version range formatting for this CVE entry.
content/solr/vex/2025-02-26-cve-2024-6763.md	Replaces < 9.8 with an explicit bounded range (≤ 9.7).
content/solr/vex/2025-01-26-cve-2025-24814.md	Replaces < 9.8.0 with an explicit bounded range (≤ 9.7).
content/solr/vex/2024-01-12-cve-2023-51074.md	Narrows versions from “all” to a bounded range and adds rationale text about the fix version.
content/solr/vex/2022-12-14-cve-velocity-tools.md	Deletes the old velocity-tools note (superseded by a more specific replacement entry).
content/solr/vex/2022-12-14-cve-tika-core.md	Deletes the old tika-core note (described as too vague to map to specific CVEs).
content/solr/vex/2022-12-14-cve-2022-42889.md	Replaces < 9.1 with ≤ 9.0 for explicit bounding.
content/solr/vex/2022-12-14-cve-2022-33980.md	Replaces < 9.1 with ≤ 9.0 for explicit bounding.
content/solr/vex/2022-12-14-cve-2022-25168.md	Replaces < 9.1 with ≤ 9.0 for explicit bounding.
content/solr/vex/2022-12-14-cve-2021-33813.md	Replaces “to present” with a bounded version range.
content/solr/vex/2022-12-14-cve-2020-27223.md	Replaces 7.3.0-present with a bounded range (7.3.0-8.x).
content/solr/vex/2022-12-14-cve-2020-13955.md	Replaces 8.1.0- today with a bounded range (8.1.0-8.x).
content/solr/vex/2022-12-14-cve-2018-8088.md	Replaces 4.x-today with a bounded range (4.x-9.1).
content/solr/vex/2022-12-14-cve-2018-10237.md	Replaces 5.4.0-today with a bounded range (5.4.0-8.x).
content/solr/vex/2022-12-14-cve-2018-10237-guava.md	Replaces 4.6.0-today with a bounded range (4.6.0-8.x).
content/solr/vex/2022-12-14-cve-2018-1000632.md	Replaces 4.6.0-today with a bounded range (4.6.0-8.x).
content/solr/vex/2022-12-14-cve-2017-15095.md	Replaces 4.7.0-today with a bounded range (4.7.0-8.x).
content/solr/vex/2022-12-14-cve-2017-14868.md	Replaces 5.2.0-today with a bounded range (5.2.0-8.x).
content/solr/vex/2022-12-14-cve-2016-6809.md	Bounds versions (…-9.10) and adds a note about Tika removal.
content/solr/vex/2022-12-14-cve-2016-1181.md	Adds a new Struts-1/velocity-tools transitive dependency VEX note with bounded affected versions.
content/solr/vex/2022-12-14-cve-2015-5237.md	Replaces 6.5.0-today with a bounded range (6.5.0-7.x).
content/solr/vex/2022-12-14-cve-2012-2098.md	Replaces 4.6.0-today with a bounded range (4.6.0-7.x).
content/solr/vex/2022-12-14-cve-2012-0881.md	Replaces ~2.9-today with a bounded range (2.9-9.10).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.