huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ImageMagick: Denial of Service via crafted FTXT file
CVE: CVE-2026-25967
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-02-24T01:29:44.758000+00:00

A flaw was found in ImageMagick. A remote attacker could exploit a stack-based buffer overflow vulnerability in the FTXT image reader. By providing a specially crafted FTXT file, an attacker could cause out-of-bounds writes on the stack, leading to a crash and resulting in a Denial of Service (DoS).

Statement: This MODERATE impact flaw in ImageMagick allows a remote attacker to cause a denial of service by providing a specially crafted FTXT file. The vulnerability, a stack-based buffer overflow in the FTXT image reader, can lead to out-of-bounds writes and application crashes. This affects ImageMagick as shipped in Red Hat Enterprise Linux 6 ELS and 7 ELS.

Remediation:
To mitigate this issue, avoid processing untrusted FTXT image files with ImageMagick. If ImageMagick must process untrusted input, consider running the application in a sandboxed environment to limit potential impact.
FreeRDP has a Heap-use-after-free in urb_select_interface
CVE: CVE-2026-24675
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:14:40.667000+00:00

A heap buffer use after free has been discovered in FreeRDP. urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2026-20636
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
MediaWiki CSS extension: Information disclosure via path traversal
CVE: CVE-2026-0669
Component: MediaWiki
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-01-07T17:46:57.285000+00:00

A flaw was found in the MediaWiki CSS extension. This vulnerability, categorized as a Path Traversal, allows a remote attacker to access restricted directories. By manipulating file paths, an attacker can read arbitrary files on the server, potentially leading to the disclosure of sensitive information.

Statement: This vulnerability is rated Moderate for Red Hat as it affects MediaWiki, a web application that, if deployed, could allow an unauthenticated attacker to perform path traversal. This could lead to unauthorized access to sensitive files on the server where MediaWiki is hosted.

Remediation:
To reduce the attack surface, restrict network access to the MediaWiki instance to only trusted clients or internal networks using firewall rules. For example, using `firewalld`, you can limit access to the web server port (e.g., 80 or 443) from specific source IP addresses or zones. This may impact legitimate users if not configured carefully.
CKEditor: Unauthorized JavaScript code execution via specially crafted markup in General HTML Support
CVE: CVE-2026-28343
Component: ckeditor
CVSS v3: 6.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-03-05T19:42:58.372000+00:00

A flaw was found in CKEditor. This cross-site scripting (XSS) vulnerability in the General HTML Support feature allows an attacker to execute unauthorized JavaScript code. This can occur by inserting specially crafted markup if the editor instance is configured with unsafe General HTML Support settings.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libiberty: Application crash via crafted C++ symbol demangling
CVE: CVE-2026-2341
Component: libiberty
Release date: 2026-02-11T11:11:00+00:00

No description is available for this CVE.

Statement: "This CVE has been marked as rejected by the assigning CNA."

Remediation:
ImageMagick: Denial of Service due to memory leak in image processing
CVE: CVE-2026-25988
Component: ImageMagick
CWE: CWE-911
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T01:48:29.928000+00:00

A flaw was found in ImageMagick. When processing certain images, the msl.c component fails to correctly update the stack index, causing an image to be stored in an incorrect memory location. This memory is then not properly freed, leading to memory leaks. A remote attacker could exploit this vulnerability by providing a specially crafted image, which can lead to a Denial of Service (DoS) condition.

Statement: MODERATE: A flaw in ImageMagick can lead to memory leaks when processing images. This issue arises because the MSL image stack index is not consistently refreshed, causing images to be stored in incorrect memory locations and not properly deallocated. Red Hat products utilizing ImageMagick for image manipulation may experience resource exhaustion under specific processing conditions.

Remediation:
To reduce the risk of memory exhaustion, it is recommended to avoid processing untrusted or maliciously crafted image files with ImageMagick. Deploying ImageMagick operations within a sandboxed environment with appropriate resource limits can further contain potential impacts from this vulnerability.
Out of bounds write in V8
CVE: CVE-2026-4450
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An out of bounds write flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=487746373

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
regmap: maple: free entry on mas_store_gfp() failure
CVE: CVE-2026-23260
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
.NET: Denial of Service via out-of-bounds read
CVE: CVE-2026-26127
Component: .net
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-10T17:05:10.752000+00:00

A flaw was found in .NET. An unauthorized attacker can exploit an out-of-bounds read vulnerability over a network, leading to a Denial of Service (DoS). This can prevent legitimate users from accessing the affected service.


Remediation:
To mitigate this issue, restrict network access to applications utilizing affected .NET components to only trusted clients or networks using firewall rules. This will limit the exposure of the vulnerable service to potential attackers. After applying firewall rules, ensure to reload or restart the network service for changes to take effect.
the_silver_searcher: Denial of Service via null pointer dereference in search_stream
CVE: CVE-2026-2642
Component: the_silver_searcher
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-18T06:32:07.600000+00:00

A security vulnerability has been detected in ggreer the_silver_searcher up to 2.2.0. The impacted element is the function search_stream of the file src/search.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libheif: Denial of Service via out-of-bounds read in Track::load function
CVE: CVE-2026-3950
Component: libheif
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-11T19:02:08.446000+00:00

A flaw was found in libheif. A local attacker could exploit an out-of-bounds read vulnerability in the `Track::load` function within the `stsz/stts` component. This manipulation could lead to a Denial of Service (DoS), making the affected system or application unavailable.


Remediation:
Enhance Handling of URIs (Oracle CPU 2026-01)
CVE: CVE-2026-21932
Component: openjdk
CWE: CWE-1287
Severity: Important
CVSS v3: 7.4/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Release date: 2026-01-20T21:21:00+00:00

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX).  Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and  21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
jsPDF: Arbitrary code execution via unsanitized input in createAnnotation method
CVE: CVE-2026-31898
Component: jspdf
CWE: CWE-94
Severity: Important
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2026-03-18T03:03:43.469000+00:00

A flaw was found in jsPDF, a JavaScript library used for generating PDF documents. This vulnerability allows a remote attacker to inject arbitrary PDF objects, including JavaScript actions, into a generated PDF. This can occur if unsanitized user input is provided to the `createAnnotation` method's `color` parameter. When a user opens or interacts with the specially crafted PDF, these injected actions may execute, potentially leading to arbitrary code execution or sensitive information disclosure.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service via circular references in MSL files
CVE: CVE-2026-25971
Component: ImageMagick
CWE: CWE-606
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T01:39:21.685000+00:00

A flaw was found in ImageMagick, a free and open-source software for editing and manipulating digital images. This vulnerability occurs because ImageMagick fails to check for circular references between two Magick Scripting Language (MSL) files. A remote attacker could exploit this by providing specially crafted MSL files, leading to a stack overflow and ultimately a Denial of Service (DoS) condition, making the software unavailable.

Statement: This MODERATE impact vulnerability in ImageMagick arises from a stack overflow when processing maliciously crafted MSL files containing circular references. Red Hat Enterprise Linux and Community Projects are affected where ImageMagick is used to process untrusted image or script files.

Remediation:
To mitigate this issue, avoid processing untrusted or maliciously crafted MSL (Magick Scripting Language) files with ImageMagick. Implement strict input validation and sanitization for any ImageMagick operations that handle external or user-supplied content.
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
CVE: CVE-2026-23149
Component: kernel
CWE: CWE-681
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's DRM (Direct Rendering Manager) subsystem. In the drm_gem_change_handle_ioctl() function, userspace can trigger a kernel warning by passing a GEM buffer object handle value larger than INT_MAX. The underlying idr_alloc() function treats this as a negative start value, triggering a WARN_ON_ONCE condition and potentially flooding kernel logs.

Statement: While this flaw allows unprivileged local users to trigger kernel warnings, the impact is limited to log spam. The kernel continues to operate normally by returning -EINVAL. No crash, memory corruption, or privilege escalation occurs.

Remediation:
IPv4-mapped IPv6 bypasses denied-peer-ip ACL
CVE: CVE-2026-27624
Component: coturn
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-02-25T04:04:17.009000+00:00

Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
platform/x86: classmate-laptop: Add missing NULL pointer checks
CVE: CVE-2026-23237
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: classmate-laptop: Add missing NULL pointer checks

In a few places in the Classmate laptop driver, code using the accel
object may run before that object's address is stored in the driver
data of the input device using it.

For example, cmpc_accel_sensitivity_store_v4() is the "show" method
of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
before calling dev_set_drvdata() for inputdev->dev.  If the sysfs
attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
call in in cmpc_accel_sensitivity_store_v4() returns NULL which
leads to a NULL pointer dereference going forward.

Moreover, sysfs attributes using the input device are added before
initializing that device by cmpc_add_acpi_notify_device() and if one
of them is accessed before running that function, a NULL pointer
dereference will occur.

For example, cmpc_accel_sensitivity_attr_v4 is added before calling
cmpc_add_acpi_notify_device() and if it is read prematurely, the
dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
returns NULL which leads to a NULL pointer dereference going forward.

Fix this by adding NULL pointer checks in all of the relevant places.


Remediation:
Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests
CVE: CVE-2026-1605
Component: org.eclipse.jetty/jetty-server
CWE: CWE-772
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T09:39:01.315000+00:00

A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.


Remediation:
Out-of-bounds array write in Xpdf 4.06 due to missing validation
CVE: CVE-2026-4407
Component: Xpdf
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-18T21:44:36.651000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick: Arbitrary code execution or denial of service via maliciously crafted kernel strings
CVE: CVE-2026-28494
Component: ImageMagick
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Release date: 2026-03-09T21:31:36.139000+00:00

A flaw was found in ImageMagick. This vulnerability, a stack buffer overflow, allows an attacker to cause stack corruption by providing maliciously crafted kernel strings. This can lead to arbitrary code execution or a denial of service (DoS), impacting the availability and integrity of the system.

Statement: This is an IMPORTANT vulnerability in ImageMagick, where a stack buffer overflow can occur when processing specially crafted morphology kernel strings. This flaw is triggered when ImageMagick processes user-controlled input containing overly long kernel names or arrays. Red Hat Enterprise Linux systems utilizing ImageMagick are affected if they process untrusted image files.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
HTSlib: Information disclosure or denial of service via out-of-bounds read in CRAM record processing
CVE: CVE-2026-31965
Component: htslib
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-03-18T18:50:37.333000+00:00

A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. This vulnerability, an out-of-bounds read, occurs in the `cram_decode_slice()` function when processing CRAM (Compressed Reference-oriented Alignment Map) records due to delayed validation of the reference ID field. A remote attacker could exploit this by providing a specially crafted CRAM file, potentially leading to the disclosure of two memory values or causing the program to crash, resulting in a Denial of Service (DoS).

Statement: MODERATE impact: The HTSlib CRAM reader is vulnerable to out-of-bounds reads due to improper input validation. This flaw can lead to information leakage or application crashes when processing specially crafted CRAM files. This affects components utilizing HTSlib for CRAM file processing, such as htslib and python-pysam in Community Projects (EPEL and Fedora).

Remediation:
TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
CVE: CVE-2026-27448
Component: pyOpenSSL
CWE: CWE-636
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-03-17T23:24:30.661000+00:00

A flaw was found in pyOpenSSL. The set_tlsext_servername_callback callback function can be used to implement Server Name Indication (SNI) during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can allow an attacker to bypass SNI-based security controls and access restricted endpoints.

Statement: This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_tlsext_servername_callback function. For the handshake to proceed incorrectly, the callback must raise an unhandled exception, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
To mitigate this flaw, ensure the callback provided to the set_tlsext_servername_callback function is wrapped in a try/except block. This block should explicitly return a failure code instead of allowing the exception to propagate.