huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Rack stored XSS in Rack::Directory
CVE: CVE-2026-25500
Component: rubygem-rack
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-18T18:59:31.964000+00:00

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
CVE: CVE-2026-23084
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's be2net driver for Emulex BladeEngine network adapters. The be_cmd_get_mac_from_list() function is called with pmac_id_valid set to false and pmac_id set to NULL, violating the function's contract. When the function attempts to store the PMAC_ID retrieved from firmware at the NULL address, a kernel crash occurs.

Statement: This vulnerability affects systems with Emulex BladeEngine network adapters during MAC address retrieval operations. The crash occurs during normal driver operation, not requiring any special attacker action. Impact is limited to denial of service through kernel panic.

Remediation:
To mitigate this issue, prevent the be2net module from being loaded if Emulex BladeEngine network adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
SVG feImage bypasses image blocking to track email opens
CVE: CVE-2026-25916
Component: roundcube
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-02-09T08:14:10.177000+00:00

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Netbeans specialKeys stack buffer overflow
CVE: CVE-2026-26269
Component: vim
CWE: CWE-121
Severity: Low
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-13T19:18:41.662000+00:00

A flaw was found in Vim. A stack-based buffer overflow in the NetBeans integration can be triggered in the special_keys function in the src/netbeans.c file via a malicious NetBeans server due to improper bounds checking, most likely resulting in a denial of service or in arbitrary command execution.

Statement: To exploit this issue, an attacker needs to set up a malicious NetBeans server or perform a Man-in-the-Middle attack on an unencrypted connection to be able to send a crafted payload into an existing NetBeans session.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this vulnerability has been rated with a low severity.

Remediation:
To mitigate this vulnerability, do not start Vim with the -nb command line option. Also, users should avoid manually running commands that initiate a NetBeans connection, such as :nbstart or :nbkey.
rust-rpm-sequoia: Denial of Service via crafted RPM file during signature verification
CVE: CVE-2026-2625
Component: rust-rpm-sequoia
CWE: CWE-347
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-17T12:34:00+00:00

No description is available for this CVE.

Statement: This MODERATE impact application level denial of service vulnerability. A specially crafted RPM file can trigger a Rust panic during OpenPGP signature verification, causing the rpm process to abort. This issue can be exploited without privileges or user interaction by processing a malicious RPM file, for example, via `rpm -Kv` or `rpm --checksig`.

Remediation:
Avoid processing untrusted or attacker-controlled RPM files with rpm -Kv or rpm --checksig. Use isolated environments or additional validation layers when handling untrusted RPM artifacts.
allocation of resources without limits or throttling via specially crafted bulk retrieval request
CVE: CVE-2026-0531
Component: kibana
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-13T21:05:51.994000+00:00

A flaw was found in Kibana. An attacker with low-level privileges equivalent to the viewer role, can exploit this vulnerability by sending a specially crafted bulk retrieval request. This request can trigger redundant database operations, causing the application to consume excessive memory, eventually resulting in a denial of service.

Statement: This issue allows a remote attacker with low-level privileges equivalent to the viewer role, which grants read access to agent policies, to cause an excessive allocation of resources by sending specially crafted bulk retrieval requests, eventually resulting in a denial of service. As the attacker must have low-level privileges to exploit this issue, this vulnerability has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
spi: tegra210-quad: Protect curr_xfer check in IRQ handler
CVE: CVE-2026-23207
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A race condition was found in the Tegra210 Quad SPI driver's IRQ handler. The curr_xfer pointer is checked for NULL without holding the spinlock, but can be set to NULL by the timeout path between the check and subsequent use, leading to a NULL pointer dereference when accessing t->len.

Statement: This vulnerability affects NVIDIA Tegra210-based systems using the Quad SPI controller. The race requires precise timing between the ISR thread and timeout handling, making it difficult to trigger but causing a kernel crash when it occurs.

Remediation:
nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
CVE: CVE-2026-23179
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()

When the socket is closed while in TCP_LISTEN a callback is run to
flush all outstanding packets, which in turns calls
nvmet_tcp_listen_data_ready() with the sk_callback_lock held.
So we need to check if we are in TCP_LISTEN before attempting
to get the sk_callback_lock() to avoid a deadlock.

Statement: A deadlock can occur in the NVMe TCP target listen path because nvmet_tcp_listen_data_ready may try to take sk_callback_lock even when it is invoked from a socket close flush callback that already holds the same lock. If this happens the accept work can stall and the target may stop accepting new connections which results in a denial of service. For the CVSS the PR:N choice in the paranoid score assumes the attacker only needs network reachability to the NVMe TCP target listener. The issue is network reachable when the nvmet tcp port is exposed. Impact is denial of service through a stuck listen callback and blocked connection handling.

Remediation:
Caddy: Path security bypass due to unsanitized backslashes
CVE: CVE-2026-27585
Component: github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-02-24T16:06:05.030000+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in DevTools
CVE: CVE-2026-3063
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-23T00:00:00+00:00

Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via DevTools. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
FreeRDP: Information disclosure or client crash via out-of-bounds read in RDPGFX channel
CVE: CVE-2026-25941
Component: freerdp
CWE: CWE-130
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2026-02-25T19:55:24.984000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer
CVE: CVE-2026-23196
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A NULL pointer dereference was found in the Intel THC (Touch Host Controller) HID driver. The driver reads from a DMA buffer without first checking if the buffer is ready, which can result in accessing a NULL pointer and crashing the kernel.

Statement: This affects systems with Intel THC touchscreen/touchpad controllers. The NULL pointer access occurs when the DMA buffer is accessed before initialization completes, requiring specific timing during device initialization or operation.

Remediation:
tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives
CVE: CVE-2026-23745
Component: node-tar
CWE: CWE-22
Severity: Important
CVSS v3: 8.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-01-16T22:00:08.769000+00:00

A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.

Statement: This vulnerability is rated Important for Red Hat products that utilize the node-tar library. The flaw allows an attacker to perform arbitrary file overwrite and symlink poisoning by crafting malicious tar archives. This occurs due to insufficient path sanitization of hardlink and symbolic link entries, even when the default secure behavior (preservePaths is false) is enabled.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
FreeRDP heap-use-after-free
CVE: CVE-2026-22857
Component: freerdp
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-01-14T17:53:54.193000+00:00

A heap use after free flaw has been discovered in FreeRDP. This heap use-after-free occurs in `irp_thread_func` because the IRP is freed by irp->Complete() and then accessed again on the error path.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HashiCorp Consul: Arbitrary file read via Kubernetes authentication configuration
CVE: CVE-2026-2808
Component: github.com/hashicorp/consul
CWE: CWE-59
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-03-11T23:08:32.414000+00:00

A flaw was found in HashiCorp Consul. When configured with Kubernetes authentication, a highly privileged attacker can exploit this vulnerability to perform arbitrary file reads. This could lead to the disclosure of sensitive information from the system.


Remediation:
Out of bounds read in Skia
CVE: CVE-2026-4460
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-18T00:00:00+00:00

An out of bounds read flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=490254124

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
xfs: check return value of xchk_scrub_create_subord
CVE: CVE-2026-23250
Component: kernel
CWE: CWE-253
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's XFS filesystem scrub code. The xchk_scrub_create_subord() function returns a mangled ENOMEM error code instead of NULL on memory allocation failure. Callers do not properly check for null pointers before using the returned value, leading to NULL pointer dereferences when memory allocation fails during scrub operations.

Statement: This flaw affects XFS filesystems using the online scrub functionality (xfs_scrub). The issue exists in code merged between kernel versions 6.2 and 6.10. Triggering this vulnerability requires invoking XFS scrub operations while the system is under memory pressure, causing allocation failures. The scrub functionality requires privileged access to execute.

Remediation:
libceph: make calc_target() set t->paused, not just clear it
CVE: CVE-2026-23047
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A deadlock vulnerability was found in the Linux kernel's Ceph client library (libceph). The calc_target() function clears the paused flag for requests but never sets it for linger requests, as that logic was only in __submit_request(). When watch requests are paused long enough to timeout and need reestablishment, they never get marked as paused and thus never get resent when unpaused. This causes rbd_reregister_watch() to wait indefinitely with rbd_dev->watch_mutex held.

Statement: This vulnerability affects systems using Ceph RBD (RADOS Block Device) storage. When network conditions cause watch requests to be paused for extended periods, the subsequent deadlock prevents RBD images from being unmapped, causing "rbd unmap" commands to hang in D state. Recovery requires a system reboot.

Remediation:
fog-kubevirt: Man-in-the-Middle vulnerability due to disabled certificate validation
CVE: CVE-2026-1530
Component: fog-kubevirt
CWE: CWE-295
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-01-28T12:40:37.424000+00:00

A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.

Statement: This is an IMPORTANT flaw in fog-kubevirt, a component used by Red Hat Satellite for managing OpenShift Virtualization/KubeVirt. The vulnerability allows a Man-in-the-Middle (MITM) attack due to disabled certificate validation. An attacker capable of intercepting traffic between Satellite and OpenShift could exploit this to compromise sensitive communications.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service due to incorrect SVE context restoration
CVE: CVE-2026-23102
Component: kernel
CWE: CWE-130
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's arm64/fpsimd component. This vulnerability involves incorrect handling during the restoration of the Scalable Vector Extension (SVE) signal context. A local user could exploit this by manipulating the SVE context, potentially leading to out-of-bounds memory reads (though this memory is not visible to the attacker) or causing a denial of service by terminating the affected task.


Remediation:
golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames
CVE: CVE-2026-27141
Component: golang.org/x/net/http2
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-26T18:50:31.830000+00:00

A flaw was found in golang.org/x/net/http2. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames, which are data packets used in the HTTP/2 protocol. Due to a missing check for null values, processing these specific frames (types 0x0a through 0x0f) can cause the server to crash. This leads to a Denial of Service (DoS) condition, making the affected server unavailable to legitimate users.


Remediation:
CVE: CVE-2026-0771
Component: Langflow PythonFunction Code Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:38:40.667000+00:00

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product.

The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-2035
Component: Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability
Release date: 2026-02-12T21:49:57.422000+00:00

Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deciso OPNsense. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of backup configuration files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28131.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: