huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Denial of Service due to a race condition in gpiolib
CVE: CVE-2026-22986
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: fix race condition for gdev->srcu

If two drivers were calling gpiochip_add_data_with_key(), one may be
traversing the srcu-protected list in gpio_name_to_desc(), meanwhile
other has just added its gdev in gpiodev_add_to_list_unlocked().
This creates a non-mutexed and non-protected timeframe, when one
instance is dereferencing and using &gdev->srcu, before the other
has initialized it, resulting in crash:

[    4.935481] Unable to handle kernel paging request at virtual address ffff800272bcc000
[    4.943396] Mem abort info:
[    4.943400]   ESR = 0x0000000096000005
[    4.943403]   EC = 0x25: DABT (current EL), IL = 32 bits
[    4.943407]   SET = 0, FnV = 0
[    4.943410]   EA = 0, S1PTW = 0
[    4.943413]   FSC = 0x05: level 1 translation fault
[    4.943416] Data abort info:
[    4.943418]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[    4.946220]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[    4.955261]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[    4.955268] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000038e6c000
[    4.961449] [ffff800272bcc000] pgd=0000000000000000
[    4.969203] , p4d=1000000039739003
[    4.979730] , pud=0000000000000000
[    4.980210] phandle (CPU): 0x0000005e, phandle (BE): 0x5e000000 for node "reset"
[    4.991736] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
...
[    5.121359] pc : __srcu_read_lock+0x44/0x98
[    5.131091] lr : gpio_name_to_desc+0x60/0x1a0
[    5.153671] sp : ffff8000833bb430
[    5.298440]
[    5.298443] Call trace:
[    5.298445]  __srcu_read_lock+0x44/0x98
[    5.309484]  gpio_name_to_desc+0x60/0x1a0
[    5.320692]  gpiochip_add_data_with_key+0x488/0xf00
    5.946419] ---[ end trace 0000000000000000 ]---

Move initialization code for gdev fields before it is added to
gpio_devices, with adjacent initialization code.
Adjust goto statements  to reflect modified order of operations

[Bartosz: fixed a build issue, removed stray newline]


Remediation:
FreeRDP: Denial of service due to incomplete fix for heap-use-after-free vulnerability
CVE: CVE-2026-27950
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T21:05:23.581000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
CVE: CVE-2026-31884
Component: freerdp
CWE: CWE-369
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-13T17:36:57.722000+00:00

A division by zero flaw has been discovered in FreeRDP. This division by zero exists in the MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service
CVE: CVE-2026-23010
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2026-01-25T00:00:00+00:00

A flaw was found in the Linux kernel. An issue exists in the `inet6_addr_del()` function, where a use-after-free vulnerability can be triggered due to an incorrect order of operations when deleting IPv6 temporary addresses. A local attacker with low privileges could exploit this flaw to potentially cause a denial of service, disclose sensitive information, or achieve privilege escalation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
@remix-run/react: React Router SSR XSS in ScrollRestoration
CVE: CVE-2026-21884
Component: react-router
CWE: CWE-79
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Release date: 2026-01-10T02:41:44.944000+00:00

A cross site scripting flaw has been discovered in the npm react-router package. The cross site scripting (XSS) vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys.


Remediation:
For details on how to apply this update, refer to Ansible Automation Platform documentation.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service or Information Disclosure via heap out-of-bounds read in DICOM file processing
CVE: CVE-2026-25982
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-02-24T01:40:45.433000+00:00

A flaw was found in ImageMagick, a software suite for image manipulation. When processing specially crafted DICOM (Digital Imaging and Communications in Medicine) files, a vulnerability allows the software to read beyond its intended memory boundaries. This can lead to a Denial of Service, causing the application to crash, or to Information Disclosure, potentially revealing sensitive data from the system's memory.

Statement: This MODERATE impact vulnerability in ImageMagick's DCM decoder allows for a heap out-of-bounds read when processing specially crafted DICOM files. This could lead to a denial of service or information disclosure. Red Hat Enterprise Linux and Community Projects are affected if ImageMagick is used to process untrusted DICOM images.

Remediation:
To mitigate this issue, avoid processing untrusted DICOM files with ImageMagick. If ImageMagick is utilized by a network service, restrict access to that service to trusted users and networks.
can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
CVE: CVE-2026-23155
Component: kernel
CWE: CWE-824
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A potential use of uninitialized variable was found in the gs_usb CAN driver. When a short read occurs before the netdev has been assigned, the error message code could dereference an undefined netdev pointer value, potentially causing a crash or information leak.

Statement: This issue affects systems using GS_USB CAN adapters. The bug occurs only on error paths when URB resubmission fails after a short read, which is an uncommon scenario. The fix initializes netdev to NULL and improves error reporting.

Remediation:
Squirrel: Denial of Service via null pointer dereference
CVE: CVE-2026-3389
Component: squirrel
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-01T10:02:07.773000+00:00

A flaw was found in Squirrel. A local user can exploit this null pointer dereference vulnerability by performing a manipulation in the `sqstd_rex_newnode` function. This can lead to a Denial of Service (DoS), making the affected system or application unavailable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
jsPDF: PDF integrity compromised via arbitrary XML injection in addMetadata function
CVE: CVE-2026-24043
Component: jsPDF
CWE: CWE-91
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2026-02-02T20:34:50.617000+00:00

A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker can inject arbitrary Extensible Metadata Platform (XMP) metadata into a generated PDF by providing unsanitized input to the `addMetadata` function. This XML injection vulnerability can compromise the integrity of the PDF, especially if the document is subsequently signed, stored, or processed.

Statement: This MODERATE impact vulnerability in jsPDF allows for the injection of arbitrary XMP metadata into generated PDFs if unsanitized input is passed to the `addMetadata` function. This could compromise the integrity of PDFs processed by affected Red Hat Advanced Cluster Security components. Red Hat Advanced Cluster Security versions 4.8 and 4.9 are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Heap buffer overflow in PDFium
CVE: CVE-2026-2648
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-18T00:00:00+00:00

Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
ASoC: tlv320adcx140: fix null pointer
CVE: CVE-2026-23006
Component: kernel
Severity: None
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: tlv320adcx140: fix null pointer

The "snd_soc_component" in "adcx140_priv" was only used once but never
set. It was only used for reaching "dev" which is already present in
"adcx140_priv".


Remediation:
jsPDF: Cross site scripting via unsanitized output options
CVE: CVE-2026-31938
Component: jspdf
CWE: CWE-79
Severity: Important
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2026-03-18T03:05:44.964000+00:00

A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker can exploit this vulnerability by providing malicious input to the `options` argument of the `output` function. When a victim creates and opens a PDF using this unsanitized input, arbitrary HTML, including scripts, can be injected and executed within the victim's browser context. This Cross-Site Scripting (XSS) vulnerability allows the attacker to extract or modify sensitive information from the victim's browser.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Argo Workflows: Security bypass allows privilege escalation via podSpecPatch field
CVE: CVE-2026-31892
Component: github.com/argoproj/argo-workflows
CWE: CWE-807
Severity: Important
CVSS v3: 9.6/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-03-11T15:41:14.376000+00:00

A flaw was found in Argo Workflows. A user with privileges to submit workflows can bypass security settings defined in a WorkflowTemplate by including a `podSpecPatch` field in their workflow submission. This allows them to circumvent restrictions, even when `templateReferencing: Strict` is configured, potentially leading to unauthorized resource access or privilege escalation.

Statement: This IMPORTANT vulnerability affects Red Hat OpenShift AI through its use of Argo Workflows. A user with low privileges can bypass WorkflowTemplate security controls by submitting workflows with a `podSpecPatch` field that overrides template definitions. The scope is changed as attackers can manipulate pod specifications beyond their intended access, resulting in high impact to confidentiality, integrity, and availability. Affects versions 2.9.0 through 4.0.1 and 3.7.10.

Remediation:
virtio_net: Fix misalignment bug in struct virtnet_info
CVE: CVE-2026-23143
Component: kernel
CWE: CWE-193
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A structure misalignment flaw was found in the Linux kernel's virtio_net driver. Due to incorrect padding handling between struct virtio_net_rss_config_trailer and the rss_hash_key_data array in struct virtnet_info, the RSS hash key passed to the device is shifted by one byte. This causes the last byte of the intended key to be truncated and replaced with a potentially uninitialized byte at the beginning, leading to incorrect RSS hash computation and minor information disclosure.

Statement: This flaw affects virtio network devices using RSS (Receive Side Scaling) functionality in virtualized environments. The impact is primarily functional (incorrect RSS hash distribution) with a minor potential for information disclosure through the uninitialized byte. No crash or privilege escalation occurs.

Remediation:
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
CVE: CVE-2026-24686
Component: github.com/theupdateframework/go-tuf/v2
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-01-27T00:45:43.422000+00:00

go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
PJSIP: heap buffer overflow in ICE with long username
CVE: CVE-2026-25994
Component: pjsip
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-11T20:56:47.340000+00:00

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vaultwarden: Unauthorized collection management operations due to improper access control
CVE: CVE-2026-27803
Component: vaultwarden
CVSS v3: 8.6/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2026-03-04T21:40:33.495000+00:00

A flaw was found in Vaultwarden. An authenticated manager, even when explicitly denied management privileges for a collection, could still perform various unauthorized management operations on that collection. This improper access control could lead to unauthorized information disclosure and data modification within the affected collection.

Statement: This is an IMPORTANT flaw in Vaultwarden, an unofficial Bitwarden compatible server. A manager with `manage=false` for a collection can still perform management operations on collections they have access to. Red Hat only ships Vaultwarden in community products - EPEL and Fedora

Remediation:
Jenkins: Information disclosure via unauthorized access to build parameters
CVE: CVE-2026-27100
Component: org.jenkins-ci.main/jenkins-core
CWE: CWE-551
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-18T14:17:44.672000+00:00

A flaw was found in Jenkins. An attacker with Item/Build and Item/Configure permissions can exploit this vulnerability by submitting Run Parameter values that refer to builds they do not have authorization to access. This allows the attacker to obtain sensitive information, including the existence of jobs, the existence of builds, and the display names of specific builds. This is an information disclosure vulnerability.

Statement: This information disclosure vulnerability in Jenkins allows an attacker with Item/Build and Item/Configure permissions to gain knowledge about the existence and display names of jobs and builds they are not authorized to access. This affects Jenkins instances in OpenShift Developer Tools & Services.

Remediation:
SimpleEval: Arbitrary code execution via sandbox escape due to improper object handling
CVE: CVE-2026-32640
Component: simpleeval
CWE: CWE-915
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-13T21:03:53.435000+00:00

A flaw was found in the Python library, SimpleEval. A remote attacker could exploit this vulnerability by providing specially crafted input that allows dangerous modules or functions to be accessed outside of the intended sandbox environment. This could lead to arbitrary code execution within the application using SimpleEval.


Remediation:
drm/amdgpu: fix drm panic null pointer when driver not support atomic
CVE: CVE-2026-23051
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix drm panic null pointer when driver not support atomic

When driver not support atomic, fb using plane->fb rather than
plane->state->fb.

(cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef)


Remediation:
CVE: CVE-2026-0788
Component: ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability
Release date: 2026-01-09T15:55:14.793000+00:00

ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a target user's privileges on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the functionality for viewing the syslog. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-28298.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick: Denial of Service via processing of MSL comment tags
CVE: CVE-2026-23952
Component: ImageMagick
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-22T00:32:52.908000+00:00

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

Statement: This vulnerability is rated Moderate for Red Hat products. A NULL pointer dereference flaw exists in ImageMagick's MSL parser when processing <comment> tags before image loading. This could allow an attacker to cause a Denial of Service (DoS) by providing a specially crafted image file. This affects ImageMagick versions 14.10.1 and below, as shipped in various Red Hat products including EPEL and Red Hat Enterprise Linux Extended Life Cycle Support (ELS) releases.

Remediation:
To mitigate this issue, users should avoid processing untrusted or specially crafted MSL (Magick Scripting Language) files with ImageMagick. Restricting the sources of MSL files and ensuring that ImageMagick only processes trusted input can reduce the risk of exploitation. If ImageMagick is used in an automated pipeline, consider implementing sandboxing mechanisms to limit the impact of potential denial-of-service attacks.
CVE: CVE-2026-0767
Component: Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability
Release date: 2026-01-09T16:36:36.010000+00:00

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-28259.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: