huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
thunderbird: Incorrect boundary conditions in the Networking: JAR component
CVE: CVE-2026-2779
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:14.195000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the Networking: JAR component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
thunderbird: Use-after-free in the IPC component
CVE: CVE-2026-0882
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T13:30:55.562000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the IPC component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ALSA: usb-audio: Prevent excessive number of frames
CVE: CVE-2026-23208
Component: kernel
CWE: CWE-805
Severity: Moderate
CVSS v3: 6.6/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A heap buffer overflow vulnerability was found in the USB audio driver. When user-supplied audio parameters result in a frame count larger than the allocated URB buffer size, the copy_to_urb() function writes beyond the buffer boundary, causing an out-of-bounds write.

Statement: Exploitation requires the ability to configure USB audio device parameters, which typically needs access to the audio device. A malicious local user could potentially craft parameters to trigger the overflow. The OOB write could lead to kernel memory corruption or crash.

Remediation:
Grafana: Denial of Service via resource exhaustion from avatar requests
CVE: CVE-2026-21720
Component: grafana
CWE: CWE-772
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-27T09:07:04.758000+00:00

A flaw was found in Grafana. A remote attacker can exploit this vulnerability by sending a sustained volume of uncached /avatar/:hash requests. This action causes the system to create and block goroutines, which are lightweight concurrent functions, leading to a continuous increase in memory usage. Over time, this resource exhaustion can cause Grafana to crash, resulting in a Denial of Service (DoS).

Statement: This IMPORTANT denial of service vulnerability in Grafana allows an unauthenticated attacker to exhaust system resources. By sending sustained requests to the `/avatar/:hash` endpoint, goroutines leak due to timed-out Gravatar image refreshes, leading to memory exhaustion and potential Grafana service crashes. This affects Grafana instances shipped with Red Hat Ceph Storage, Red Hat Enterprise Linux, and Red Hat In-Vehicle OS.

Remediation:
Pagure: Information disclosure via unrestricted reStructuredText include directive
CVE: CVE-2026-3312
Component: pagure
CVSS v3: 7.4/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-03-13T00:00:00+00:00

A flaw was found in Pagure's rendering engine for reStructuredText (RST) files. An authenticated user can exploit an unrestricted `.. include::` directive within RST files to read arbitrary internal files from the server hosting Pagure. This information disclosure vulnerability allows unauthorized access to sensitive data on the server.

Statement: This vulnerability in Pagure's reStructuredText (RST) rendering engine allows an authenticated user to read arbitrary internal files from the server. This is due to the `.. include::` directive in the docutils library not being restricted or jailed during the rendering process within Pagure. Exploitation requires an authenticated user to craft a malicious RST file.

Remediation:
Django: Denial of Service via crafted HTML inputs
CVE: CVE-2026-1285
Component: Django
CWE: CWE-770
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-03T14:35:50.254000+00:00

A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (when `html=True`), or through the `truncatechars_html` and `truncatewords_html` template filters. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.

Statement: This is a MODERATE impact denial-of-service flaw in Django. Applications utilizing Django that process untrusted HTML inputs with a large number of unmatched end tags through the `Truncator.chars()` or `Truncator.words()` methods (with `html=True`), or the `truncatechars_html` and `truncatewords_html` template filters, may experience resource exhaustion. This can lead to the application becoming unavailable.

Remediation:
For details on how to apply this update, refer to Ansible Automation Platform documentation.
For details on how to apply this update, refer to Ansible Automation Platform documentation.
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
To mitigate this issue, applications utilizing Django should avoid processing untrusted HTML content through the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods with `html=True`, or the `truncatechars_html` and `truncatewords_html` template filters. Restrict the use of these functions to only trusted inputs where the HTML structure is controlled and validated.
net/sched: act_ife: avoid possible NULL deref
CVE: CVE-2026-23064
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's traffic control IFE (Inter-FE) action module. The tcf_ife_encode() function fails to verify that ife_encode() returns a valid pointer before use. When ife_encode() returns NULL, subsequent calls to ife_tlv_meta_encode() attempt to dereference the NULL pointer, triggering a kernel crash during packet processing.

Statement: This vulnerability was discovered by syzkaller and affects systems using the tc (traffic control) IFE action for inter-forwarding-element metadata encapsulation. Triggering this flaw requires the ability to configure traffic control rules, typically requiring root or CAP_NET_ADMIN privileges. The impact is denial of service through a kernel crash during packet transmission.

Remediation:
thunderbird: Privilege escalation in the Netmonitor component
CVE: CVE-2026-2780
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:14.850000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Privilege escalation in the Netmonitor component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Insufficient policy enforcement in Clipboard
CVE: CVE-2026-3938
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-10T00:00:00+00:00

An insufficient policy enforcement flaw was found in the Clipboard component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=474763968

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Linux kernel mISDN: Denial of Service via data race
CVE: CVE-2026-23121
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's mISDN timer device. A local user with low privileges could exploit a data race condition around the `dev->work` flag. This can lead to incorrect wakeup logic, causing processes to block longer than expected or experience missed notifications, ultimately resulting in a Denial of Service (DoS).

Statement: A data race was reported by KCSAN in the mISDN timer device code around the dev work flag. The flag is written from the ioctl path via misdn_add_timer and it is read locklessly from the read and poll paths. In particular mISDN_read checks the flag in the wait_event_interruptible condition after dropping dev lock and mISDN_poll checks the same flag to decide whether to report EPOLLIN. Without proper annotations the compiler and CPU may reorder or optimize these accesses and readers may observe stale or inconsistent values. This can result in incorrect wakeup logic such as missed notifications spurious readiness or processes blocking longer than expected.

Remediation:
CVE: CVE-2026-2041
Component: Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability
Release date: 2026-02-12T21:48:29.259000+00:00

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability.

The specific flaw exists within the zabbixagent_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28250.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Memory safety bugs fixed in Firefox 148 and Thunderbird 148
CVE: CVE-2026-2807
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:34.035000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
libxml2: Denial of Service via uncontrolled recursion in XML catalog processing
CVE: CVE-2026-0990
Component: libxml2
CWE: CWE-674
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-15T00:00:00+00:00

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.

Statement: This vulnerability is rated Moderate for Red Hat products. The flaw in libxml2, an XML parsing library, is configuration-dependent and occurs when processing specially crafted XML catalogs with self-referencing delegate URI entries. Exploitation requires an attacker to provide such a catalog, leading to a Denial of Service by crashing affected applications.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP global-buffer-overflow
CVE: CVE-2026-22858
Component: freerdp
CWE: CWE-787
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-01-14T17:56:29.729000+00:00

A global buffer overflow flaw has been discovered in FreeRDP. This global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access.

Statement: Red Hat products in their default configuration employ Address Space Layout Randomization (ASLR) which drastically increases the complexity of the successful exploitation of this flaw.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
procfs: avoid fetching build ID while holding VMA lock
CVE: CVE-2026-23199
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A deadlock vulnerability was found in the procfs PROCMAP_QUERY ioctl handler. When fetching the optional build ID while holding the VMA lock (mmap_lock), a circular lock dependency can occur with the inode mutex, causing a system deadlock.

Statement: This deadlock can be triggered by any local user using the PROCMAP_QUERY ioctl on /proc/[pid]/maps while another process is performing file I/O. The deadlock results in denial of service but not privilege escalation or data exposure.

Remediation:
dmaengine: omap-dma: fix dma_pool resource leak in error paths
CVE: CVE-2026-23033
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: omap-dma: fix dma_pool resource leak in error paths

The dma_pool created by dma_pool_create() is not destroyed when
dma_async_device_register() or of_dma_controller_register() fails,
causing a resource leak in the probe error paths.

Add dma_pool_destroy() in both error paths to properly release the
allocated dma_pool resource.


Remediation:
platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
CVE: CVE-2026-23176
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: toshiba_haps: Fix memory leaks in add/remove routines

toshiba_haps_add() leaks the haps object allocated by it if it returns
an error after allocating that object successfully.

toshiba_haps_remove() does not free the object pointed to by
toshiba_haps before clearing that pointer, so it becomes unreachable
allocated memory.

Address these memory leaks by using devm_kzalloc() for allocating
the memory in question.


Remediation:
GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay
CVE: CVE-2026-3083
Component: GStreamer
CWE: CWE-787
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:41:31.185000+00:00

A flaw was found in GStreamer. This out-of-bounds write vulnerability exists within the `rtpqdm2depay` element, specifically during the processing of X-QDM Real-time Transport Protocol (RTP) payload elements. A remote attacker can exploit this by providing malformed user-supplied data to the `packetid` element, leading to a write past the end of an allocated array. Successful exploitation can result in arbitrary code execution in the context of the current process.

Statement: This IMPORTANT vulnerability in GStreamer allows remote code execution due to an out-of-bounds write when processing X-QDM RTP payload elements. Red Hat products using GStreamer for RTP stream handling are affected if they process untrusted media streams.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nghttp2: Denial of Service via malformed HTTP/2 frames after session termination
CVE: CVE-2026-27135
Component: nghttp2
CWE: CWE-617
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T17:59:02.045000+00:00

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).


Remediation:
stack-based buffer overflow in MNG encoder
CVE: CVE-2026-28690
Component: ImageMagick
CWE: CWE-121
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:39:53.647000+00:00

A flaw was found in ImageMagick. Processing a specially crafted image with the MNG encoder can cause a stack-based buffer overflow due to a missing bounds check, leading to a denial of service and potentially arbitrary code execution.

Statement: To exploit this issue, an attacker needs to convince a user to process a specially crafted file that makes ImageMagick use the MNG encoder.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability to a denial of service.

Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To mitigate this vulnerability, disable the vulnerable encoder by adding the following line to the ImageMagick policy.xml file, typically located in the directory /etc/ImageMagick-7/, /etc/ImageMagick-6/ or /etc/ImageMagick/:

~~~
<policy domain="coder" rights="none" pattern="MNG" />
~~~

To reduce the risk of exploitation, avoid processing untrusted MNG files with ImageMagick. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
nfsd: check that server is running in unlock_filesystem
CVE: CVE-2026-22989
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check that server is running in unlock_filesystem

If we are trying to unlock the filesystem via an administrative
interface and nfsd isn't running, it crashes the server. This
happens currently because nfsd4_revoke_states() access state
structures (eg., conf_id_hashtbl) that has been freed as a part
of the server shutdown.

[   59.465072] Call trace:
[   59.465308]  nfsd4_revoke_states+0x1b4/0x898 [nfsd] (P)
[   59.465830]  write_unlock_fs+0x258/0x440 [nfsd]
[   59.466278]  nfsctl_transaction_write+0xb0/0x120 [nfsd]
[   59.466780]  vfs_write+0x1f0/0x938
[   59.467088]  ksys_write+0xfc/0x1f8
[   59.467395]  __arm64_sys_write+0x74/0xb8
[   59.467746]  invoke_syscall.constprop.0+0xdc/0x1e8
[   59.468177]  do_el0_svc+0x154/0x1d8
[   59.468489]  el0_svc+0x40/0xe0
[   59.468767]  el0t_64_sync_handler+0xa0/0xe8
[   59.469138]  el0t_64_sync+0x1ac/0x1b0

Ensure this can't happen by taking the nfsd_mutex and checking that
the server is still up, and then holding the mutex across the call to
nfsd4_revoke_states().

Statement: This is a local administrative-triggered use-after-free in NFSD state revocation: when the NFSD server is not running, an admin “unlock filesystem” operation can dereference freed NFSD state structures and crash the kernel. The issue is not reachable via normal remote NFS client traffic (it requires access to the NFSD control/administrative interface).

Remediation:
Incorrect security UI in Digital Credentials
CVE: CVE-2026-0904
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-01-13T00:00:00+00:00

Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Linux kernel erofs: Denial of Service via Use-After-Free in file-backed directio mounts
CVE: CVE-2026-23224
Component: kernel
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-18T00:00:00+00:00

A flaw was found in the Linux kernel's erofs filesystem. A local user could exploit a Use-After-Free (UAF) vulnerability, which occurs due to a race condition when performing file-backed mounts with the 'directio' option. This flaw can lead to a kernel panic, resulting in a Denial of Service (DoS) for the system.

Statement: A use after free can occur in EROFS file backed mounts when the directio option is enabled. The read path allocates an erofs_fileio_rq that contains a bio and an embedded kiocb. The request is submitted through vfs_iocb_iter_read into the backing filesystem direct IO path. When direct IO completes asynchronously the completion callback erofs_fileio_ki_complete can run in the dio completion workqueue and free the request structure while the submit side still has execution paths that may access fields derived from the kiocb such as ki_filp. This race can result in a kernel NULL dereference or a use after free and can panic the kernel. For the CVSS the PR is L in a paranoid configuration because the affected configuration might be reachable in some environments through delegated mount capabilities or misconfiguration.

Remediation:
Use after free in CSS
CVE: CVE-2026-2313
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-10T00:00:00+00:00

Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Integer overflow in WebML
CVE: CVE-2026-3914
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An integer overflow flaw was found in the WebML component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=481776048

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
CVE: CVE-2026-0791
Component: ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2026-01-09T15:55:36.196000+00:00

ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the Replaces header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28300.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: