huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Storybook: Remote Code Execution via WebSocket Hijacking
CVE: CVE-2026-27148
Component: storybook
CWE: CWE-346
Severity: Important
CVSS v3: 8.8/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
Release date: 2026-02-25T21:46:48.967000+00:00

A flaw was found in Storybook's development server. This vulnerability allows a remote attacker to achieve Remote Code Execution or persistent Cross-Site Scripting by exploiting WebSocket hijacking. The attack can occur if a developer visits a malicious website while their local Storybook development server is active, or directly by an unauthenticated attacker if the server is publicly accessible. This is due to insufficient validation of WebSocket connection origins and unsanitized input, leading to significant security risks.

Statement: This vulnerability affects the Storybook development server, which is not intended for production deployments. Exploitation typically requires a developer to visit a malicious website while their local Storybook dev server is active. If the dev server is publicly exposed, unauthenticated attackers can directly interact with it, potentially leading to persistent cross-site scripting (XSS) or remote code execution (RCE). This primarily impacts development environments using Storybook within Red Hat AMQ, Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and Community Projects.

Remediation:
CVE: CVE-2026-0778
Component: Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability
Release date: 2026-01-09T16:57:43.713000+00:00

Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Enel X JuiceBox 40 charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the telnet service, which listens on TCP port 2000 by default. The issue results from the lack of authentication prior to allowing remote connections. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23285.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in WebGPU
CVE: CVE-2026-2315
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-10T00:00:00+00:00

Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
libsoup: Credential leakage via HTTP redirects
CVE: CVE-2026-1539
Component: libsoup
CWE: CWE-201
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Release date: 2026-01-28T00:00:00+00:00

A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Medium. Exploitation requires network access but does not require authentication, user interaction, or special privileges. Successful exploitation may result in the disclosure of proxy authentication credentials to unintended third parties. While the issue does not directly allow code execution or service disruption, leakage of authentication material represents a meaningful confidentiality risk. The root cause is improper handling of sensitive headers during HTTP redirect processing.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
GNU Binutils: Information disclosure via specially crafted XCOFF object file
CVE: CVE-2026-3441
Component: binutils
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Release date: 2026-03-02T11:11:00+00:00

A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.

Statement: This MODERATE impact out-of-bounds read vulnerability in GNU Binutils affects Red Hat products. Exploitation requires a local attacker to persuade a user to process a specially crafted XCOFF object file with the `ld` linker. This limits the attack vector to scenarios involving user interaction with untrusted files.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HTSlib: BGZF index file reader has a heap buffer overflow
CVE: CVE-2026-31970
Component: htslib
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T19:53:18.719000+00:00

A flaw was found in HTSlib, a library used for handling bioinformatics file formats. A remote attacker could exploit an integer overflow vulnerability when a user opens a specially crafted GZI (GZIP Index) file. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
GIMP: Remote Code Execution via ICO File Parsing Vulnerability
CVE: CVE-2026-0797
Component: gimp
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T22:10:04.716000+00:00

A flaw was found in GIMP. This vulnerability, a heap-based buffer overflow, occurs during the parsing of ICO files. A remote attacker can exploit this by convincing a user to open a malicious file or visit a malicious web page, leading to arbitrary code execution. The issue is due to a lack of proper validation of user-supplied data length before it is copied to a memory buffer.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Kibana: Denial of Service due to improper input validation in Email Connector
CVE: CVE-2026-0543
Component: Kibana
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-13T21:10:38.663000+00:00

A flaw was found in Kibana's Email Connector. An authenticated attacker with view-level privileges can exploit this vulnerability by providing a specially crafted email address parameter. This improper input validation can lead to an excessive allocation of resources, resulting in a complete denial of service (DoS) for all users until the service is manually restarted.

Statement: This vulnerability is rated Moderate for Red Hat products as it allows an authenticated attacker with view-level privileges to trigger a denial of service in Kibana's Email Connector. By providing a specially crafted email address, the attacker can cause excessive resource allocation, leading to service unavailability until a manual restart. This impact is limited to deployments where the Email Connector is enabled and accessible to authenticated users.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
gix-date: Undefined behavior due to invalid string generation
CVE: CVE-2026-0810
Component: gix-date
CWE: CWE-135
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-01-01T00:00:00+00:00

A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.

Statement: This vulnerability is rated Moderate for Red Hat products. A flaw in the `gix-date` library can generate invalid non-UTF8 strings, leading to undefined behavior when processed. The most likely impact from a successful attack is to data integrity, by the malicious data being able to corrupt data being hold in memory and to system availability as it eventually may lead to the software using the gix_date library to crash.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Cesanta Mongoose: Improper cryptographic signature verification in Poly1305 Authentication Tag Handler
CVE: CVE-2026-2968
Component: mongoose
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-23T03:02:07.673000+00:00

A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the component Poly1305 Authentication Tag Handler. The manipulation results in improper verification of cryptographic signature. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
io_uring: ensure ctx->rings is stable for task work flags manipulation
CVE: CVE-2026-23275
Component: kernel
CWE: CWE-366
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel's io_uring subsystem. This vulnerability occurs during the resizing of an io_uring ring when task work is added with specific flags (DEFER_TASKRUN or SETUP_TASKRUN). A race condition allows the IORING_SQ_TASKRUN flag to be set in an unstable memory region, which can lead to unpredictable system behavior or system instability.

Statement: This flaw affects io_uring applications using DEFER_TASKRUN mode with ring resizing. The race window exists between swapping to a new rings structure and freeing the old one, where task work can manipulate flags in freed memory. Exploiting this requires an application using the specific io_uring configuration and triggering ring resize operations concurrently with task work additions.

Remediation:
Google Chrome: Chromium: WebRTC in Google Chrome: Heap corruption via crafted HTML page
CVE: CVE-2026-4445
Component: WebRTC
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-20T01:34:47.124000+00:00

A flaw was found in WebRTC, a technology used in Google Chrome for real-time communication. A remote attacker could exploit this vulnerability, known as a 'use-after-free', by tricking a user into opening a malicious web page. This could lead to memory corruption, potentially allowing the attacker to take control of the affected system or cause it to crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
security constraint bypass with HTTP/0.9
CVE: CVE-2026-24733
Component: tomcat
CWE: CWE-20
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-17T18:50:43.871000+00:00

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.

Statement: This flaw is only exploitable when Tomcat is configured to allow HEAD requests but deny GET requests to the same resource, a very unlikely configuration. Due to this reason, this flaw has been rated with a low severity.

Remediation:
To mitigate this vulnerability, ensure that security constraints are consistent across similar methods (e.g., if GET is denied, HEAD should likely be denied) or block HTTP/0.9 traffic via a reverse proxy or firewall, if it is not required.
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2026-20635
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
CVE: CVE-2026-22258
Component: suricata
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-27T16:17:29.903000+00:00

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the `stream.reassembly.depth` setting will limit the amount of data that can be buffered. For DCERPC/SMB, the `stream.reassembly.depth` can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
command injection via process names in action command templates
CVE: CVE-2026-32608
Component: glances
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-18T06:03:22.153000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
CVE: CVE-2026-23019
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: marvell: prestera: fix NULL dereference on devlink_alloc() failure

devlink_alloc() may return NULL on allocation failure, but
prestera_devlink_alloc() unconditionally calls devlink_priv() on
the returned pointer.

This leads to a NULL pointer dereference if devlink allocation fails.
Add a check for a NULL devlink pointer and return NULL early to avoid
the crash.


Remediation:
FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation
CVE: CVE-2026-24676
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:15:33.646000+00:00

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. A malicious server can trigger a client‑side heap use after free causing a crash.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Koa: Host header injection vulnerability due to malformed HTTP Host header parsing
CVE: CVE-2026-27959
Component: koa
CWE: CWE-20
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Release date: 2026-02-26T01:45:45.668000+00:00

A flaw was found in Koa’s ctx.hostname API used in Node.js applications. The function incorrectly parses specially crafted HTTP Host headers containing an @ character, which can cause the extracted hostname value to differ from the intended origin. An attacker can exploit this behavior by sending a malicious Host header to influence the hostname value returned by ctx.hostname. Applications that rely on this value for generating absolute URLs, password reset links, or email verification links without additional validation may be susceptible to Host header injection attacks.

Statement: Red Hat Product Security considers this issue as High severity. 

A remote, unauthenticated attacker can send a specially crafted HTTP Host header containing a valid RFC 3986 userinfo component (using the @ delimiter). Due to improper parsing of the authority field in the ctx.hostname API, the application may treat attacker-controlled input as the hostname value. Exploitation occurs when the server processes the malicious request and does not require user interaction (UI:N).

Applications that rely on ctx.hostname to construct absolute URLs, such as: password reset links, email verification links, OAuth redirect URIs, or webhook endpoints, may generate security sensitive URLs that reference an attacker controlled domain. This can result in integrity violations, including manipulation of authentication flows or account takeover scenarios. Integrity impact is therefore rated High.

Confidentiality impact is considered Low because disclosure of sensitive data depends on application-specific usage patterns. The vulnerability does not automatically expose information from the server. However, if an affected application uses the manipulated hostname value to generate security-sensitive links such as password reset or email verification URLs and embeds tokens in those links without additional validation, a victim who later follows such a link may inadvertently disclose those tokens to an attacker controlled domain. Such disclosure is conditional, application-dependent like how the application constructs URLs. Also, the subsequent user interaction beyond the initial exploitation, the confidentiality impact is assessed as Low (C:L).

Remediation:
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates once they become available.
CVE: CVE-2026-1344
Component: Insecure file permissions in Enforce Recovery Key Portal
Release date: 2026-02-17T23:43:20.540000+00:00

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: