huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Denial of Service in SMB client due to race condition
CVE: CVE-2026-23230
Component: kernel
CWE: CWE-821
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-18T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability is caused by a race condition during concurrent updates to internal flags, which can lead to stale data being restored. A remote attacker with low privileges could exploit this, potentially causing unexpected behavior or a denial of service in the SMB client.


Remediation:
Valkey: Denial of Service via specially crafted network requests
CVE: CVE-2026-27623
Component: Valkey
CWE: CWE-617
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-23T19:43:45.736000+00:00

A flaw was found in Valkey. A malicious actor with network access to Valkey can cause the system to shut down by sending a specially crafted request. This occurs because the system does not properly reset its networking state after processing an empty request, leading to an assertion failure. This vulnerability results in a Denial of Service (DoS), making the Valkey database unavailable.

Statement: This is an IMPORTANT denial-of-service vulnerability in Valkey versions 9.0.0 through 9.0.2. A remote, unauthenticated attacker with network access to a Valkey instance can send a malformed request, causing the server to terminate due to an assertion failure. This issue arises from improper state handling after processing an empty request.

Remediation:
miniaudio: Denial of Service via crafted WAV files due to heap out-of-bounds read
CVE: CVE-2026-32837
Component: miniaudio
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-17T19:10:06.080000+00:00

A flaw was found in miniaudio. An attacker can exploit a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser by processing a specially crafted WAV file. This vulnerability, caused by improper null-termination handling in the coding history field, allows for out-of-bounds reads past the allocated metadata pool. Successful exploitation can lead to application crashes or a denial of service.

Statement: This MODERATE vulnerability affects miniaudio and imhex in Red Hat Community Projects. A heap out-of-bounds read in the WAV BEXT parser is triggered by processing crafted WAV files. Exploitation requires user interaction to open the malicious file (UI:R) and local access. Impact is limited to availability through application crashes.

Remediation:
ImageMagick: Denial of Service and information disclosure via integer overflow in SIXEL decoder
CVE: CVE-2026-28493
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:29:39.035000+00:00

A flaw was found in ImageMagick. An integer overflow vulnerability exists in the SIXEL decoder, which allows a remote attacker to perform an out-of-bounds write via a specially crafted image. This can lead to a Denial of Service (DoS) and potentially information disclosure.

Statement: This MODERATE impact vulnerability affects ImageMagick in Red Hat Enterprise Linux and Community Projects. An integer overflow in the SIXEL decoder can lead to an out-of-bounds write when processing a specially crafted image, potentially resulting in a denial of service or other undefined behavior.

Remediation:
To mitigate this issue, avoid processing untrusted SIXEL image files with ImageMagick. If ImageMagick must process untrusted content, consider running it within a sandboxed environment to limit potential impact.
CVE: CVE-2026-2350
Component: Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.
Release date: 2026-02-19T23:10:05.500000+00:00

Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in CSS
CVE: CVE-2026-3541
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
cpp-httplib: Denial of Service via malformed Content-Length header
CVE: CVE-2026-31870
Component: cpp-httplib
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-11T17:57:49.744000+00:00

A flaw was found in cpp-httplib. A remote attacker, acting as a malicious server or through a man-in-the-middle position, can send a specially crafted HTTP response with a malformed Content-Length header. This lack of input validation and exception handling causes the client application to crash, resulting in a Denial of Service (DoS).

Statement: This IMPORTANT vulnerability in cpp-httplib allows a remote attacker, acting as a malicious server or through a man-in-the-middle position, to trigger a denial of service in client applications utilizing the streaming API. The flaw occurs due to insufficient input validation of the Content-Length header, leading to an application crash. No authentication or user interaction is required for successful exploitation. This affects Red Hat Community Projects that incorporate cpp-httplib, such as those in EPEL and Fedora.

Remediation:
f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
CVE: CVE-2026-23267
Component: kernel
Severity: None
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Calibre: Arbitrary file write and code execution via path traversal in PDB readers
CVE: CVE-2026-26065
Component: calibre
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T01:54:03.128000+00:00

A flaw was found in calibre. This path traversal vulnerability allows a local user to write arbitrary files with arbitrary content and extensions to any location where the user has write permissions. This occurs when processing specially crafted PDB (Program Database) e-book files. Successful exploitation can lead to potential arbitrary code execution and Denial of Service (DoS) through file corruption.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Type Confusion in V8
CVE: CVE-2026-4457
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A type confusion flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=488803413

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Rack Directory Traversal via Rack:Directory
CVE: CVE-2026-22860
Component: rubygem-rack
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-18T18:45:02.095000+00:00

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Insufficient policy enforcement in DevTools
CVE: CVE-2026-3941
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-10T00:00:00+00:00

An insufficient policy enforcement flaw was found in the DevTools component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=474670215

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
heap-based buffer over-read in stl_check_normal_vector() in src/normals.c
CVE: CVE-2026-2653
Component: admesh
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T11:02:07.838000+00:00

A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vLLM: Server-Side Request Forgery bypass via inconsistent URL parsing
CVE: CVE-2026-25960
Component: vLLM
CWE: CWE-474
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2026-03-09T21:01:01.827000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this Server-Side Request Forgery (SSRF) bypass vulnerability in the `load_from_url_async` method. The flaw occurs because the URL validation and the actual HTTP request handling use different parsing libraries, leading to inconsistencies. This allows an attacker to bypass existing SSRF protections, potentially leading to the disclosure of sensitive information from internal network resources.

Statement: This is an IMPORTANT vulnerability. The vLLM component, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, is affected by a Server-Side Request Forgery (SSRF) protection bypass. This flaw allows an attacker to circumvent existing SSRF safeguards due to inconsistent URL parsing between the validation layer and the underlying HTTP client when the `load_from_url_async` method is utilized.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
gpio: virtuser: fix UAF in configfs release path
CVE: CVE-2026-23158
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: virtuser: fix UAF in configfs release path

The gpio-virtuser configfs release path uses guard(mutex) to protect
the device structure. However, the device is freed before the guard
cleanup runs, causing mutex_unlock() to operate on freed memory.

Specifically, gpio_virtuser_device_config_group_release() destroys
the mutex and frees the device while still inside the guard(mutex)
scope. When the function returns, the guard cleanup invokes
mutex_unlock(&dev->lock), resulting in a slab use-after-free.

Limit the mutex lifetime by using a scoped_guard() only around the
activation check, so that the lock is released before mutex_destroy()
and kfree() are called.


Remediation:
jsPDF: Arbitrary code execution via unsanitized input in Acroform module
CVE: CVE-2026-24737
Component: jsPDF
CWE: CWE-917
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2026-02-02T20:29:05.011000+00:00

A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker could exploit this vulnerability by providing unsanitized input to specific methods within the Acroform module, such as AcroformChoiceField.addOption or AcroFormCheckBox.appearanceState. This allows the attacker to inject arbitrary PDF objects, including JavaScript actions, which are then executed when a victim opens the crafted PDF document, leading to arbitrary code execution.

Statement: This IMPORTANT vulnerability in jsPDF affects Red Hat Advanced Cluster Security (RHACS) where it could allow arbitrary JavaScript execution. The flaw occurs if an attacker provides a specially crafted PDF document containing injected JavaScript actions, and a victim subsequently opens this malicious document. Exploitation requires user interaction with a malicious file.

Remediation:
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
To mitigate this vulnerability, avoid processing untrusted or unverified PDF documents with applications utilizing the jsPDF library. Ensure that any input provided to jsPDF's AcroForm methods and properties is properly sanitized to prevent the injection of arbitrary PDF objects and JavaScript actions. This operational control reduces the risk of arbitrary JavaScript execution.
ImageMagick: Information disclosure due to heap buffer over-read when processing malformed images
CVE: CVE-2026-25576
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-24T00:38:34.337000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. This heap buffer over-read vulnerability occurs when processing images where the -extract dimensions are larger than the -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. A remote attacker could exploit this vulnerability to potentially disclose sensitive information.

Statement: This MODERATE impact vulnerability in ImageMagick is due to a heap buffer over-read when processing images with -extract dimensions larger than -size dimensions. This flaw could lead to out-of-bounds memory reads from a heap-allocated buffer. Red Hat Enterprise Linux and Community Projects are affected if ImageMagick is used to process untrusted image data with these specific parameters.

Remediation:
To mitigate this issue, avoid processing untrusted or malformed image files with ImageMagick. Users should exercise caution when handling images from untrusted sources.
Use after free in Base
CVE: CVE-2026-4441
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An use after free flaw was found in the Base component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=489381399

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
CVE: CVE-2026-23271
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the `__perf_event_overflow()` function and functions like `perf_remove_from_context()` or `perf_event_exit_event()`. This occurs because `__perf_event_overflow()` may execute with only preemption disabled, allowing other operations to free resources, such as BPF (Berkeley Packet Filter) programs, that the overflow path expects to be available. This could lead to system instability or a denial of service.


Remediation:
React Router CSRF in Action/Server Action Request Processing
CVE: CVE-2026-22030
Component: react-router
CWE: CWE-352
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2026-01-10T02:42:44.603000+00:00

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects
CVE: CVE-2026-27727
Component: com.mchange/mchange-commons-java
CWE: CWE-502
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-02-25T16:01:04.187000+00:00

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted `javax.naming.Reference` or serialized object to an application using the library. This can provoke the application to download and execute arbitrary malicious code due to mchange-commons-java's independent implementation of Java Naming and Directory Interface (JNDI) dereferencing, which supports remote code loading. This could lead to arbitrary code execution within the affected application.


Remediation:
To apply this update, follow the standard installation procedure for your platform:

* https://docs.redhat.com/en/documentation/red_hat_build_of_debezium/3.2.7/html-single/installing_debezium_on_openshift/index
*
https://docs.redhat.com/en/documentation/red_hat_build_of_debezium/3.2.7/html-single/installing_debezium_on_rhel/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A  possible integer overflow vulnerability in RawTherapee/RawTherapee
CVE: CVE-2026-24808
Component: rawtherapee
Release date: 2026-01-27T08:44:58.065000+00:00

Integer Overflow or Wraparound vulnerability in RawTherapee (rtengine modules). This vulnerability is associated with program files dcraw.Cc.

This issue affects RawTherapee: through 5.11.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds read in Web Speech
CVE: CVE-2026-3916
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An out of bounds read flaw was found in the Web Speech component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=482828615

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Evolution Data Server: Arbitrary file deletion via inconsistent URI handling
CVE: CVE-2026-2604
Component: evolution-data-server
CWE: CWE-73
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Release date: 2026-02-16T11:11:00+00:00

No description is available for this CVE.

Statement: This is a MODERATE impact flaw in evolution-data-server where inconsistent URI handling can lead to arbitrary file deletion. A Flatpak application with D-Bus access to the addressbook service can exploit this vulnerability by crafting a malicious URI with directory traversal sequences, potentially deleting critical Flatpak override files on the host filesystem.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
DTLS cookie callback buffer overflow
CVE: CVE-2026-27459
Component: pyOpenSSL
CWE: CWE-120
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-17T23:34:28.483000+00:00

A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.

Statement: This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.
CVE: CVE-2026-0793
Component: ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2026-01-09T15:55:56.451000+00:00

ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the InformaCast functionality. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28302.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: