huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
PJSIP: Denial of Service via malformed H.264 bitstream processing
CVE: CVE-2026-26203
Component: pjsip
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-19T19:28:58.859000+00:00

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
default CORS configuration allows Cross-Origin credential theft
CVE: CVE-2026-32610
Component: glances
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2026-03-18T16:31:12.154000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
macvlan: fix possible UAF in macvlan_forward_source()
CVE: CVE-2026-23001
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix possible UAF in macvlan_forward_source()

Add RCU protection on (struct macvlan_source_entry)->vlan.

Whenever macvlan_hash_del_source() is called, we must clear
entry->vlan pointer before RCU grace period starts.

This allows macvlan_forward_source() to skip over
entries queued for freeing.

Note that macvlan_dev are already RCU protected, as they
are embedded in a standard netdev (netdev_priv(ndev)).

https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u

Statement: A use-after-free can occur in macvlan source-mode forwarding when a source hash entry is deleted while the transmit/forwarding path still dereferences entry.vlan without proper RCU protection. A local attacker who can configure macvlan networking can race deletion with packet processing to crash the kernel and potentially achieve memory corruption.
Exploitation typically requires the CAP_NET_ADMIN capability (often within a user namespace).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module macvlan from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Cap'n Proto: Integer overflow in KJ-HTTP chunk size
CVE: CVE-2026-32240
Component: capnproto
CWE: CWE-190
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-12T19:35:57.374000+00:00

A flaw was found in the KJ-HTTP component of Cap’n Proto when processing HTTP messages that use Transfer-Encoding: chunked. If a chunk size is parsed as a value equal to or greater than 2^64, the value may be truncated when converted to a 64-bit integer. An attacker could exploit this behavior by sending specially crafted HTTP messages containing excessively large chunk sizes. This may cause incorrect interpretation of HTTP message boundaries and could theoretically enable HTTP request or response smuggling in applications that rely on the affected HTTP implementation.

Statement: This issue is rated Moderate severity by Red Hat Product Security, because exploitation requires specially crafted malformed HTTP requests containing extremely large chunk size values that exceed normal protocol limits. Such requests are not generated by typical HTTP clients and may be rejected by intermediary infrastructure such as reverse proxies or load balancers before reaching the affected parser. 

Additionally, meaningful exploitation generally depends on differences in how multiple HTTP components interpret malformed chunked encoding values. Because these conditions require non-standard inputs and specific deployment configurations, the attack complexity is considered High. The potential impact is limited to inconsistencies in HTTP request parsing that could enable limited request smuggling scenarios, without directly causing service crashes or enabling arbitrary code execution.

Remediation:
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Jenkins: Arbitrary file write and potential code execution through crafted archives
CVE: CVE-2026-33001
Component: jenkins
CWE: CWE-22
Severity: Important
CVSS v3: 8.5/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-03-18T15:15:23.950000+00:00

A flaw was found in Jenkins. This vulnerability allows attackers with Item/Configure permission, or those who can control agent processes, to exploit unsafe handling of symbolic links during the extraction of .tar and .tar.gz archives. By crafting malicious archives, an attacker can write files to arbitrary locations on the filesystem. This could enable the deployment of malicious scripts or plugins on the Jenkins controller, potentially leading to unauthorized code execution.


Remediation:
Angular: Cross-site scripting vulnerability in Template Compiler
CVE: CVE-2026-22610
Component: angular
CWE: CWE-79
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Release date: 2026-01-10T03:35:40.727000+00:00

A flaw was found in Angular. An attacker could exploit a cross-site scripting (XSS) vulnerability in the Angular Template Compiler due to improper sanitization of `href` and `xlink:href` attributes within SVG `<script>` elements. This could allow an attacker to inject malicious scripts into web pages, leading to arbitrary code execution in the user's browser.

Statement: This vulnerability is rated Moderate for Red Hat products. A cross-site scripting (XSS) flaw in the Angular Template Compiler allows an attacker to inject malicious scripts into web pages. This affects several Red Hat products, including Red Hat Enterprise Application Platform, Red Hat JBoss Fuse, Red Hat OpenStack Platform, Red Hat Quay, Red Hat Advanced Cluster Management for Kubernetes, and Red Hat Single Sign-On. Certain components within Red Hat Enterprise Linux and Community Projects are either not affected or will not be fixed.

Remediation:
This issue can be mitigating by avoiding the usage of dynamic bindings, this can be achieved by not using the Angular template binding `[attr.href]` when handling SVG `<script>` elements.
If there's a need of using dynamic bindings, users are advised to validate the input against a strict list of trusted URLs on the server side before serving the values to the template.
RSA crate: Denial of Service due to malformed prime in private key generation
CVE: CVE-2026-21895
Component: RSA
CWE: CWE-703
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-08T14:06:29.288000+00:00

A flaw was found in the RSA crate, an RSA implementation in Rust. When an application attempts to create an RSA private key from its components, a remote attacker could provide a malformed prime value of '1'. This invalid input causes the application to panic, leading to a Denial of Service (DoS).

Statement: This vulnerability is rated Low for Red Hat products. The `rsa` crate, an RSA implementation in Rust, can panic when creating an RSA private key if one of the provided prime numbers is `1`. This scenario requires specific, invalid input during key generation and does not affect standard RSA operations or key usage.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Header injection in http.cookies.Morsel in Python
CVE: CVE-2026-0672
Component: cpython
CWE: CWE-93
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Release date: 2026-01-20T21:52:33.925000+00:00

An injection flaw has been discovered in Python. When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb
CVE: CVE-2026-24681
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:20:39.732000+00:00

A heap buffer use after free has been discovered in FreeRDP. Asynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure
CVE: CVE-2026-23144
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Data Access MONitor (DAMON) sysfs interface. A local attacker, typically a privileged user, could exploit a cleanup bug during DAMON context setup. If the setup fails after the attrs directory is created, stale sysfs directories are left behind. This can lead to a local denial of service, making the DAMON sysfs interface unusable until a system reboot, and potentially cause a kernel memory leak if repeatedly triggered.

Statement: A cleanup bug in the DAMON sysfs interface can leave behind stale sysfs directories when setting up a DAMON context fails after the attrs directory hierarchy has been created. The context directory setup sequence creates attrs and its subdirectories early and then proceeds to configure additional objects such as targets and schemes. If one of these later steps fails the old error path only released the attrs kobject without removing the attrs subdirectories. This leaves a partially created sysfs tree that can make the DAMON sysfs interface effectively unusable until reboot and also leaks kernel memory tied to the unremoved sysfs structures. The practical impact is local denial of service of DAMON sysfs management and a potential kernel memory leak if the failing setup path can be triggered repeatedly. Triggering the bug requires local access to the DAMON sysfs configuration interface and a way to induce setup failure. This is typically restricted to privileged users but may vary by deployment.

Remediation:
Katello: Denial of Service and potential information disclosure via SQL injection
CVE: CVE-2026-4324
Component: rubygem-katello
CWE: CWE-89
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-03-17T13:18:00+00:00

A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.

Statement: This flaw in the Katello plugin for Red Hat Satellite allows an attacker to inject arbitrary SQL commands into the `/api/hosts/bootc_images` API endpoint. By manipulating the `sort_by` parameter, an attacker could trigger database errors, cause a Denial of Service, or potentially perform Boolean-based Blind SQL injection. This affects Red Hat Satellite installations utilizing the Katello plugin.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Roundcube Webmail: Cascading Style Sheets (CSS) injection via mishandled comments
CVE: CVE-2026-26079
Component: roundcubemail
CVSS v3: 4.6/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-02-11T04:27:24.156000+00:00

A flaw was found in Roundcube Webmail. This vulnerability allows for Cascading Style Sheets (CSS) injection, a technique where an attacker can inject malicious styling code into a web page. This occurs due to the application mishandling comments. Successful exploitation could lead to the disclosure of sensitive information.

Statement: MODERATE: This flaw in Roundcube Webmail allows for Cascading Style Sheets (CSS) injection due to mishandled comments. This could potentially lead to information disclosure or defacement within the webmail interface when processing specially crafted email content.

Remediation:
Mongoose: Information disclosure due to insufficiently random values in DNS transaction ID handling
CVE: CVE-2026-2966
Component: Mongoose
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-02-23T02:02:08.202000+00:00

A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
CVE: CVE-2026-20904
Component: gitea
CWE: CWE-639
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-01-22T22:01:51.762000+00:00

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.


Remediation:
CVE: CVE-2026-2435
Component: ASSET-7706
Release date: 2026-02-19T23:09:30.641000+00:00

Tanium addressed a SQL injection vulnerability in Asset.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libssh: Denial of Service via out-of-bounds read in SFTP extension name handler
CVE: CVE-2026-3731
Component: libssh
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-08T10:32:19.482000+00:00

A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive.

Statement: A MODERATE impact out-of-bounds read vulnerability exists in libssh's SFTP extension. A remote attacker could exploit this flaw by manipulating an argument to the `sftp_extensions_get_name/sftp_extensions_get_data` functions, potentially leading to a denial of service or information disclosure. This affects Red Hat Enterprise Linux versions utilizing libssh.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Bokeh: Information disclosure and unauthorized actions via flawed WebSocket origin validation
CVE: CVE-2026-21883
Component: Bokeh
CWE: CWE-1385
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-01-08T01:20:53.479000+00:00

A flaw was found in Bokeh, an interactive visualization library. A remote attacker could exploit flawed origin validation logic in WebSocket connections, which are used for real-time communication between a web browser and a server. By luring a victim to a malicious website, the attacker could bypass the server's security checks, establish a connection, and interact with the Bokeh server on the victim's behalf. This could lead to unauthorized access to sensitive data or modification of visualizations.

Statement: This vulnerability is rated Moderate for Red Hat OpenShift AI (RHOAI) as it affects Bokeh server applications with an allowlist configured. An attacker could exploit this by registering a malicious domain that appears to be a subdomain of an allowed origin, then luring a victim to visit it. This allows the attacker to initiate a WebSocket connection to the vulnerable Bokeh server, potentially accessing sensitive data or modifying visualizations on behalf of the victim.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Parser unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21929
Component: mysql
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are 9.0.0-9.5.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write
CVE: CVE-2026-31883
Component: freerdp
Severity: Moderate
Release date: 2026-03-13T17:35:17.411000+00:00

No description is available for this CVE.


Remediation:
FreeRDP: Denial of Service via use after free in ecam_channel_write
CVE: CVE-2026-24678
Component: freerdp
CWE: CWE-825
Severity: Important
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:17:27.040000+00:00

A denial of service flaw has been found in FreeRDP. A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
idpf: fix error handling in the init_task on load
CVE: CVE-2026-23017
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix error handling in the init_task on load

If the init_task fails during a driver load, we end up without vports and
netdevs, effectively failing the entire process. In that state a
subsequent reset will result in a crash as the service task attempts to
access uninitialized resources. Following trace is from an error in the
init_task where the CREATE_VPORT (op 501) is rejected by the FW:

[40922.763136] idpf 0000:83:00.0: Device HW Reset initiated
[40924.449797] idpf 0000:83:00.0: Transaction failed (op 501)
[40958.148190] idpf 0000:83:00.0: HW reset detected
[40958.161202] BUG: kernel NULL pointer dereference, address: 00000000000000a8
...
[40958.168094] Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf]
[40958.168865] RIP: 0010:idpf_vc_event_task+0x9b/0x350 [idpf]
...
[40958.177932] Call Trace:
[40958.178491]  <TASK>
[40958.179040]  process_one_work+0x226/0x6d0
[40958.179609]  worker_thread+0x19e/0x340
[40958.180158]  ? __pfx_worker_thread+0x10/0x10
[40958.180702]  kthread+0x10f/0x250
[40958.181238]  ? __pfx_kthread+0x10/0x10
[40958.181774]  ret_from_fork+0x251/0x2b0
[40958.182307]  ? __pfx_kthread+0x10/0x10
[40958.182834]  ret_from_fork_asm+0x1a/0x30
[40958.183370]  </TASK>

Fix the error handling in the init_task to make sure the service and
mailbox tasks are disabled if the error happens during load. These are
started in idpf_vc_core_init(), which spawns the init_task and has no way
of knowing if it failed. If the error happens on reset, following
successful driver load, the tasks can still run, as that will allow the
netdevs to attempt recovery through another reset. Stop the PTP callbacks
either way as those will be restarted by the call to idpf_vc_core_init()
during a successful reset.


Remediation: