huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Gitea: Cross-Site Scripting (XSS) via forbidden URL scheme in links
CVE: CVE-2025-68946
Component: gitea
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-12-26T04:14:03.775000+00:00

A flaw was found in Gitea. A remote attacker could exploit this vulnerability by injecting a forbidden URL scheme, such as `javascript:`, into a link. This could lead to Cross-Site Scripting (XSS), allowing the attacker to execute arbitrary code in the user's browser or disclose sensitive information.

Statement: This vulnerability is rated Moderate. In the Red Hat context, all listed OpenShift Pipelines components are not affected as the vulnerable code is not present.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
pidfs: validate extensible ioctls
CVE: CVE-2025-40217
Component: kernel
CWE: CWE-1287
Severity: Moderate
CVSS v3: 5.5/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pidfs: validate extensible ioctls

Validate extensible ioctls stricter than we do now.


Remediation:
Linux kernel: usb: cdc-acm: Memory corruption due to improper buffer size check
CVE: CVE-2025-21704
Component: kernel
CWE: CWE-130
Severity: Moderate
CVSS v3: 6.6/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2025-02-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: cdc-acm: Check control transfer buffer size before access

If the first fragment is shorter than struct usb_cdc_notification, we can't
calculate an expected_size. Log an error and discard the notification
instead of reading lengths from memory outside the received data, which can
lead to memory corruption when the expected_size decreases between
fragments, causing `expected_size - acm->nb_index` to wrap.

This issue has been present since the beginning of git history; however,
it only leads to memory corruption since commit ea2583529cd1
("cdc-acm: reassemble fragmented notifications").

A mitigating factor is that acm_ctrl_irq() can only execute after userspace
has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will
do that automatically depending on the USB device's vendor/product IDs and
its other interfaces.


Remediation:
rxrpc: Fix irq-disabled in local_bh_enable()
CVE: CVE-2025-38525
Component: kernel
CWE: CWE-820
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-16T00:00:00+00:00

A flaw was found in the Linux kernel’s Remote Execution RPC (RxRPC) implementation, where the rxrpc_assess_MTU_size() function is invoked with interrupts disabled during the handling of an incoming call. This function queries the IP layer for route MTU information, but the IP layer internally uses local_bh_enable(), which can raise warnings if executed while IRQs are disabled. As a result, a race condition could occur, leading to kernel warnings and potential instability.


Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
CVE: CVE-2025-13225
Component: Tanium addressed an arbitrary file deletion vulnerability in TanOS.
Release date: 2025-11-18T23:53:45.523000+00:00

Tanium addressed an arbitrary file deletion vulnerability in TanOS.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
binder: fix yet another UAF in binder_devices
CVE: CVE-2025-38175
Component: kernel
Severity: None
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

binder: fix yet another UAF in binder_devices

Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices")
addressed a use-after-free where devices could be released without first
being removed from the binder_devices list. However, there is a similar
path in binder_free_proc() that was missed:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100
  Write of size 8 at addr ffff0000c773b900 by task umount/467
  CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   binder_remove_device+0xd4/0x100
   binderfs_evict_inode+0x230/0x2f0
   evict+0x25c/0x5dc
   iput+0x304/0x480
   dentry_unlink_inode+0x208/0x46c
   __dentry_kill+0x154/0x530
   [...]

  Allocated by task 463:
   __kmalloc_cache_noprof+0x13c/0x324
   binderfs_binder_device_create.isra.0+0x138/0xa60
   binder_ctl_ioctl+0x1ac/0x230
  [...]

  Freed by task 215:
   kfree+0x184/0x31c
   binder_proc_dec_tmpref+0x33c/0x4ac
   binder_deferred_func+0xc10/0x1108
   process_one_work+0x520/0xba4
  [...]
  ==================================================================

Call binder_remove_device() within binder_free_proc() to ensure the
device is removed from the binder_devices list before being kfreed.


Remediation:
Nodejs denial of service
CVE: CVE-2025-59466
Component: nodejs
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A stack overflow flaw has been discovered in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path
CVE: CVE-2025-22128
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path

If a shared IRQ is used by the driver due to platform limitation, then the
IRQ affinity hint is set right after the allocation of IRQ vectors in
ath12k_pci_msi_alloc(). This does no harm unless one of the functions
requesting the IRQ fails and attempt to free the IRQ.

This may end up with a warning from the IRQ core that is expecting the
affinity hint to be cleared before freeing the IRQ:

kernel/irq/manage.c:

	/* make sure affinity_hint is cleaned up */
	if (WARN_ON_ONCE(desc->affinity_hint))
		desc->affinity_hint = NULL;

So to fix this issue, clear the IRQ affinity hint before calling
ath12k_pci_free_irq() in the error path. The affinity will be cleared once
again further down the error path due to code organization, but that does
no harm.


Remediation:
mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose()
CVE: CVE-2025-68291
Component: kernel
CWE: CWE-909
Severity: Important
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A divide-by-zero vulnerability was found in the MPTCP implementation in the Linux kernel. When mptcp_do_fastclose() calls tcp_send_active_reset(), the rcv_mss field is uninitialized (zero), causing a division by zero in __tcp_select_window(). This results in a kernel crash.

Statement: This can be triggered through MPTCP socket operations during fast close scenarios. The impact is denial of service via kernel panic.

Remediation:
Aerc Attachment Path Traversal Vulnerability
CVE: CVE-2025-49466
Component: aerc
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2025-06-05T00:00:00+00:00

A flaw was found in aerc. The `open.go` file in the `commands/msgview` directory improperly concatenates attachment names, leading to a directory traversal vulnerability. This flaw allows a network attacker to specify a crafted attachment name. This issue allows arbitrary file access on the system running aerc.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Inappropriate implementation in Extensions
CVE: CVE-2025-3069
Component: chromium-browser
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-04-02T00:42:10.880000+00:00

Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service via double-increment of reference count in netfilter
CVE: CVE-2025-39764
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ctnetlink: remove refcounting in expectation dumpers

Same pattern as previous patch: do not keep the expectation object
alive via refcount, only store a cookie value and then use that
as the skip hint for dump resumption.

AFAICS this has the same issue as the one resolved in the conntrack
dumper, when we do
  if (!refcount_inc_not_zero(&exp->use))

to increment the refcount, there is a chance that exp == last, which
causes a double-increment of the refcount and subsequent memory leak.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
iio: backend: make sure to NULL terminate stack buffer
CVE: CVE-2025-22082
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: backend: make sure to NULL terminate stack buffer

Make sure to NULL terminate the buffer in
iio_backend_debugfs_write_reg() before passing it to sscanf(). It is a
stack variable so we should not assume it will 0 initialized.


Remediation:
Command injection in Lite XL
CVE: CVE-2025-12121
Component: lite-xl
CVSS v3: 7.3/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-11-20T16:39:05.297000+00:00

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Lack of Image Dimension Resource Limits in JXL of GraphicsMagick
CVE: CVE-2025-27795
Component: GraphicsMagick
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Release date: 2025-03-07T00:00:00+00:00

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
xfs: fix a UAF problem in xattr repair
CVE: CVE-2025-68784
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix a UAF problem in xattr repair

The xchk_setup_xattr_buf function can allocate a new value buffer, which
means that any reference to ab->value before the call could become a
dangling pointer.  Fix this by moving an assignment to after the buffer
setup.


Remediation:
Fiber: Predictable UUIDs from randomness source errors can lead to security bypasses
CVE: CVE-2025-66630
Component: github.com/gofiber/fiber/v2
CVSS v3: 7.7/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Fiber web framework (github.com/gofiber/fiber/v2). On Go versions prior to 1.24, the framework's Universally Unique Identifier (UUID) generation functions do not return an error when the underlying cryptographic randomness source fails. This can cause applications to use predictable or low-entropy UUIDs in security-sensitive areas, such as session management or Cross-Site Request Forgery (CSRF) protection. An attacker could potentially exploit this by leveraging environmental conditions or application-specific weaknesses, which may significantly affect confidentiality and integrity.

Statement: This vulnerability is classified as Important rather than Critical because exploitation depends on an environmental failure of the randomness source rather than a condition directly controllable by a remote attacker. The flaw does not enable immediate unauthenticated remote code execution or direct system compromise; instead, impact occurs only if crypto/rand fails and the application subsequently relies on predictable UUID values in security-sensitive contexts. Since triggering conditions typically involve misconfigured containers, restricted environments, or degraded entropy sources, successful exploitation requires additional environmental or application-specific weaknesses. Therefore, while confidentiality and integrity can be significantly affected once triggered, the lack of a direct, easily exploitable remote attack path aligns the issue with Important severity rather than Critical.

Remediation:
wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
CVE: CVE-2025-37795
Component: kernel
CWE: CWE-416
Severity: None
Release date: 2025-05-01T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025051018-REJECTED-949b@gregkh/

Remediation:
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
CVE: CVE-2025-38460
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

atm: clip: Fix potential null-ptr-deref in to_atmarpd().

atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip
causes unregister hang").

However, it is not enough because to_atmarpd() is called without RTNL,
especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable.

Also, there is no RTNL dependency around atmarpd.

Let's use a private mutex and RCU to protect access to atmarpd in
to_atmarpd().


Remediation:
platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init
CVE: CVE-2025-40352
Component: kernel
Severity: None
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init

The lock-related debug logic (CONFIG_LOCK_STAT) in the kernel is noting
the following warning when the BlueField-3 SOC is booted:

  BUG: key ffff00008a3402a8 has not been registered!
  ------------[ cut here ]------------
  DEBUG_LOCKS_WARN_ON(1)
  WARNING: CPU: 4 PID: 592 at kernel/locking/lockdep.c:4801 lockdep_init_map_type+0x1d4/0x2a0
<snip>
  Call trace:
   lockdep_init_map_type+0x1d4/0x2a0
   __kernfs_create_file+0x84/0x140
   sysfs_add_file_mode_ns+0xcc/0x1cc
   internal_create_group+0x110/0x3d4
   internal_create_groups.part.0+0x54/0xcc
   sysfs_create_groups+0x24/0x40
   device_add+0x6e8/0x93c
   device_register+0x28/0x40
   __hwmon_device_register+0x4b0/0x8a0
   devm_hwmon_device_register_with_groups+0x7c/0xe0
   mlxbf_pmc_probe+0x1e8/0x3e0 [mlxbf_pmc]
   platform_probe+0x70/0x110

The mlxbf_pmc driver must call sysfs_attr_init() during the
initialization of the "count_clock" data structure to avoid
this warning.


Remediation:
mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
CVE: CVE-2025-21641
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mptcp: sysctl: blackhole timeout: avoid using current->nsproxy

As mentioned in the previous commit, using the 'net' structure via
'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only
  from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops'
  (null-ptr-deref), e.g. when the current task is exiting, as spotted by
  syzbot [1] using acct(2).

The 'pernet' structure can be obtained from the table->data using
container_of().


Remediation:
GNU Wget2: Memory corruption and crash via filename sanitization logic with attacker-controlled URLs
CVE: CVE-2025-69195
Component: wget2
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2025-12-29T00:00:00+00:00

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.

Statement: This vulnerability is rated Important for Red Hat. A stack-based buffer overflow in GNU Wget2's filename sanitization logic can be triggered when processing attacker-controlled URL paths with filename restriction options (e.g., `--restrict-file-names=windows, unix, or ascii`) enabled. Exploitation requires user interaction to invoke wget2, leading to memory corruption, application crash, and potential further malicious activities.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Revert "drm/amd: Keep display off while going into S4"
CVE: CVE-2025-38030
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:
Revert "drm/amd: Keep display off while going into S4"

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025061941-REJECTED-38a2@gregkh/

Remediation:
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects
CVE: CVE-2025-68157
Component: webpack
CWE: CWE-918
Severity: Low
CVSS v3: 3.8/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

An SSRF flaw has been discovered in Webpack. When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
specially crafted git repository can lead to arbitrary code execution
CVE: CVE-2025-41390
Component: TruffleHog
CWE: CWE-829
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-10-20T14:15:29.418000+00:00

A flaw was found in the git functionality of TruffleHog. Scanning a specially crafted git repository copied file-for-file, such as via tar, cp, rsync or other tools, with a malicious core.fsmonitor configuration option specified in the .git/config file can cause arbitrary code execution.

Statement: This flaw affects only repositories copied file-for-file, such as via tar, cp, rsync or similar tools, it does not affect the regular use case of cloned repositories, limiting the impact of this vulnerability.

Remediation:
Before scanning the repository, check the contents of the .git/config file, looking for a malicious fsmonitor configuration option, such as system programs not related to project maintenance.
tracing: fprobe events: Fix possible UAF on modules
CVE: CVE-2025-37845
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tracing: fprobe events: Fix possible UAF on modules

Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module
refcount") moved try_module_get() from __find_tracepoint_module_cb()
to find_tracepoint() caller, but that introduced a possible UAF
because the module can be unloaded before try_module_get(). In this
case, the module object should be freed too. Thus, try_module_get()
does not only fail but may access to the freed object.

To avoid that, try_module_get() in __find_tracepoint_module_cb()
again.


Remediation: