huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Memory management flaw in ath10k Wi-Fi driver can lead to denial of service
CVE: CVE-2026-23133
Component: kernel
CWE: CWE-763
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's ath10k Wi-Fi driver. This memory management bug occurs during the copy engine ring teardown process, where the driver incorrectly frees Direct Memory Access (DMA) coherent buffers. A local attacker with low privileges could exploit this by triggering the flawed teardown, potentially leading to memory leaks, resource exhaustion, and system instability, resulting in a Denial of Service (DoS).

Statement: A memory management bug exists in the ath10k copy engine ring teardown path. The driver allocates DMA coherent descriptor rings with dma_alloc_coherent and stores the original addresses in unaligned fields. It also derives aligned addresses for device consumption. The buggy code passed the aligned CPU pointer and aligned DMA address into dma_free_coherent. The DMA API requires that dma_free_coherent is called with the exact CPU virtual address and DMA handle that were returned by dma_alloc_coherent. Freeing with adjusted aligned addresses can cause incorrect freeing behavior. This may manifest as DMA API warnings. It may also lead to memory leaks and resource exhaustion. Under some configurations it could contribute to instability during device reset or module unload.

Remediation:
Optimizer unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21948
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
thunderbird: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
CVE: CVE-2026-2792
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:22.842000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
action termination via KillAction when guests must login
CVE: CVE-2026-28790
Component: OliveTin
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T19:34:53.951000+00:00

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
PyMuPDF: Arbitrary file write via path traversal vulnerability
CVE: CVE-2026-3029
Component: PyMuPDF
CWE: CWE-22
Severity: Important
CVSS v3: 8.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-19T15:53:38.778000+00:00

A flaw was found in PyMuPDF. This vulnerability, involving path traversal, allows an attacker to write arbitrary files to unintended locations on the system. The flaw is present in the embedded `get` function within the `_main_.py` file. Successful exploitation could lead to system compromise or data corruption.


Remediation:
To mitigate this issue, ensure that applications utilizing PyMuPDF, especially those processing untrusted documents, are run within a sandboxed environment with strict limitations on file system write access. Additionally, validate and sanitize all input paths before they are processed by PyMuPDF's `get` function to prevent path traversal.
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
CVE: CVE-2026-32237
Component: @backstage/plugin-scaffolder-backend
CWE: CWE-497
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-12T18:38:57.156000+00:00

A data exposure flaw has been discovered in the @backstage/plugin-scaffolder-backend npm library. Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Python pkgutil.get_data(): Path Traversal via improper resource argument validation
CVE: CVE-2026-3479
Component: python
CWE: CWE-22
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-03-18T18:13:42.288000+00:00

A flaw was found in Python's `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service in ALSA ctxfi driver due to out-of-bounds access
CVE: CVE-2026-23076
Component: kernel
CWE: CWE-129
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) ctxfi driver. A local user with access to the sound device and ALSA control interfaces can exploit this out-of-bounds memory access vulnerability by exercising mixer controls. This issue stems from the improper re-initialization of a loop index field, which can cause the system to access memory outside of its allocated bounds. Successful exploitation can lead to a kernel crash or unstable system behavior, resulting in a Denial of Service (DoS).

Statement: An out of bounds access can occur in the ALSA ctxfi mixer code because the rsc.conj field is used as a loop index in amixer_index and sum_index. The driver did not reliably reinitialize conj when setting up amixer and sum resources. If conj retains a stale value, the index callbacks can use it to access fixed size arrays out of range, which was observed by fuzzers and reported by UBSAN as an array index out of bounds. The issue is reachable through normal mixer control handling once the ctxfi driver is loaded. A local user with access to the sound device and ALSA control interfaces can trigger the relevant paths by exercising mixer controls. For the CVSS the PR is L because access to ALSA control devices is typically mediated by local permissions and group membership. The primary impact is availability because an out of bounds access in kernel space can crash the kernel or lead to unstable behavior.

Remediation:
CoreDNS: Denial of Service vulnerability due to predictable pseudo-random number generation
CVE: CVE-2026-26018
Component: github.com/coredns/coredns
CWE: CWE-1241
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-06T15:35:50.801000+00:00

A flaw was found in CoreDNS, a DNS server that chains plugins. A remote attacker can exploit this flaw by sending specially crafted DNS queries. This vulnerability exists in CoreDNS's loop detection plugin due to the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name. Successful exploitation can lead to a denial of service (DoS) by crashing the DNS server.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component
CVE: CVE-2026-0890
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-01-13T13:30:59.089000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVE: CVE-2026-2004
Component: postgresql
CWE: CWE-1287
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-12T13:00:08.857000+00:00

A type validation flaw has been discovered in PostgreSQL. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
DoS in Calls plugin via malformed msgpack in websocket request.
CVE: CVE-2026-2454
Component: github.com/mattermost/mattermost-server/
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Release date: 2026-03-16T20:10:16.644000+00:00

A denial of service flaw has been discovered in mattermost server. Affected versions fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
devalue: Denial of Service due to improper input validation
CVE: CVE-2026-22775
Component: devalue
CWE: CWE-405
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-15T18:59:37.499000+00:00

A flaw was found in devalue, a JavaScript library used for serializing values. A remote attacker could exploit this vulnerability by providing specially crafted input to the `devalue.parse` function. This improper input validation, specifically during the ArrayBuffer hydration process, can cause the application to consume excessive CPU time and memory. This ultimately leads to a denial of service (DoS), making the affected system unavailable to legitimate users.

Statement: This vulnerability is rated Important for Red Hat. The `devalue` JavaScript library, when used by applications to parse untrusted external input, is susceptible to a denial of service. Specially crafted input to the `devalue.parse` function can lead to excessive CPU and memory consumption, rendering the affected system unavailable. Red Hat products such as Red Hat Build of Podman Desktop and Red Hat Trusted Artifact Signer are affected if they process untrusted data using the vulnerable `devalue.parse` function.

Remediation:
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Kernel: Memory leak in rocker component leads to denial of service
CVE: CVE-2026-23164
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the `rocker` component of the Linux kernel. This memory leak vulnerability allows a local attacker with low privileges to repeatedly add and remove ports. This action prevents memory from being properly freed, leading to memory exhaustion and a denial of service (DoS) on the system.

Statement: A MODERATE impact memory leak flaw exists in the `rocker` component of the Linux kernel. A local attacker with low privileges can exploit this by repeatedly adding and removing ports, leading to memory exhaustion and a denial of service. This affects Red Hat Enterprise Linux 7, 8, 9, 10 and Red Hat In-Vehicle OS 2. Red Hat Enterprise Linux 6 is not affected as the vulnerable code is not present.

Remediation:
If the `rocker` kernel module is not required for system operation, it can be prevented from loading to mitigate this vulnerability. To blacklist the `rocker` module, create a configuration file:

```
echo "blacklist rocker" | sudo tee /etc/modprobe.d/blacklist-rocker.conf
```

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality if the `rocker` module is actively used by network devices.
libexif: Buffer overwrite via integer underflow in MakerNotes decoding
CVE: CVE-2026-32775
Component: libexif
CWE: CWE-191
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-03-16T06:31:36.015000+00:00

A flaw was found in libexif. When decoding MakerNotes, an integer underflow can occur in the exif_mnote_data_get_value function if a zero size is passed. This can lead to a buffer overwrite, potentially allowing an attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service (DoS).


Remediation:
To mitigate this issue, avoid processing untrusted image files that may contain specially crafted EXIF MakerNotes. Restrict the use of applications that process EXIF data to trusted sources only.
FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow
CVE: CVE-2026-23534
Component: freerdp
CWE: CWE-122
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-19T17:09:55.715000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can trigger a client-side heap buffer overflow in the ClearCodec bands decode path. This vulnerability, caused by crafted band coordinates, allows writes past the end of the destination surface buffer. Successful exploitation can lead to a crash, resulting in a denial of service (DoS), and potentially arbitrary code execution.

Statement: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.

Remediation:
Calibre: Brute-force protection bypass via X-Forwarded-For header manipulation
CVE: CVE-2026-27824
Component: calibre
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-27T19:46:07.612000+00:00

A flaw was found in calibre, an e-book manager. A remote attacker can bypass the brute-force protection mechanism in the calibre Content Server by manipulating the X-Forwarded-For header. This vulnerability allows attackers to circumvent IP-based bans, making the server susceptible to credential stuffing and password guessing attacks, potentially leading to unauthorized access.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
file-type: Denial of Service via excessive memory growth from crafted ZIP files
CVE: CVE-2026-32630
Component: file-type
CWE: CWE-409
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-13T20:54:16.960000+00:00

A flaw was found in file-type, a utility for detecting file types. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP file to an application using file-type's buffer or file-based detection functions. This can lead to excessive memory growth, causing a Denial of Service (DoS) due to the application attempting to inflate and process a much larger payload than expected.


Remediation:
Linux kernel (net: usb: pegasus): Denial of Service due to memory leak
CVE: CVE-2026-23021
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A flaw was found in the Linux kernel's `net: usb: pegasus` module. A local attacker with low privileges could exploit this vulnerability when the `usb_submit_urb()` function fails during asynchronous writes to device registers. This can lead to a memory leak, potentially causing a Denial of Service (DoS) due to resource exhaustion.


Remediation:
pnpm: Arbitrary file write via path traversal in binary fetcher leading to remote code execution
CVE: CVE-2026-23888
Component: pnpm
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2026-01-26T21:37:17.483000+00:00

A flaw was found in pnpm, a package manager. A path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. This can occur through malicious ZIP entries containing directory traversal sequences (../) or absolute paths, or by a crafted BinaryResolution.prefix field. An attacker could exploit this to overwrite sensitive files, potentially leading to remote code execution (RCE).

Statement: This vulnerability is rated Moderate for Red Hat Enterprise Application Platform. A path traversal flaw in pnpm's binary fetcher allows malicious packages to write files outside the intended directory. This could lead to remote code execution if an attacker can provide a specially crafted package.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Suricata http1: infinite recursion in decompression
CVE: CVE-2026-22260
Component: suricata
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-27T17:30:39.582000+00:00

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a workaround, use default values for `request-body-limit` and `response-body-limit`.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
CVE: CVE-2026-24137
Component: github.com/sigstore/sigstore
CWE: CWE-22
Severity: Moderate
CVSS v3: 5.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Release date: 2026-01-23T00:04:19.046000+00:00

A path traversal flaw has been discovered in the sigstore go library. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.