huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
quickjs-ng quickjs: Heap-based buffer overflow leading to information disclosure or denial of service
CVE: CVE-2026-1145
Component: quickjs-ng
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-01-19T08:02:08.519000+00:00

A flaw was found in quickjs-ng quickjs. This vulnerability, a heap-based buffer overflow, exists in the `js_typed_array_constructor_ta` function. A remote attacker can exploit this by sending specially crafted input, which could lead to unauthorized information disclosure or system instability (denial of service).

Statement: This vulnerability is rated Important for Red Hat products. A heap-based buffer overflow flaw in the `js_typed_array_constructor_ta` function of `quickjs-ng` can be exploited remotely. This issue affects components that embed `quickjs-ng`, such as `radare2` in Red Hat Community Projects, when processing untrusted JavaScript content.

Remediation:
thunderbird: Use-after-free in the Storage: IndexedDB component
CVE: CVE-2026-2769
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:06.912000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the Storage: IndexedDB component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
NestJS: Authentication bypass via Fastify path-normalization
CVE: CVE-2026-2293
Component: nestjs
CWE: CWE-551
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-27T16:15:11.784000+00:00

A flaw was found in NestJS. When a NestJS application uses @nestjs/platform-fastify with Fastify path-normalization options enabled, a remote attacker can exploit this to bypass authentication and authorization middleware. This bypass allows unauthorized access to protected resources, compromising the application's security controls.


Remediation:
filippo.io/edwards25519: Cryptographic integrity bypass due to incorrect MultiScalarMult results
CVE: CVE-2026-26958
Component: filippo.io/edwards25519
CWE: CWE-824
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-19T23:01:26.923000+00:00

A flaw was found in filippo.io/edwards25519, a Go library used for cryptographic operations. This vulnerability occurs in the MultiScalarMult function when it processes points that are not properly initialized or are not the identity point. Such conditions can lead to incorrect cryptographic results, potentially allowing an attacker to bypass security checks or compromise data integrity. This issue impacts the reliability of cryptographic primitives within applications utilizing the library.


Remediation:
GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
CVE: CVE-2026-2047
Component: gimp
CWE: CWE-131
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T22:23:41.576000+00:00

A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the ICNS file parsing component allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, where the target must open a specially crafted malicious file or visit a malicious page. This issue stems from insufficient validation of user-supplied data length before copying it to a buffer, leading to potential arbitrary code execution in the context of the current process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Gradio: Open Redirect vulnerability allows redirection to arbitrary external URLs.
CVE: CVE-2026-28415
Component: Gradio
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-02-27T21:44:51.956000+00:00

A flaw was found in Gradio, an open-source Python package. The _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter. A remote attacker can exploit this vulnerability by crafting a malicious URL, leading to an open redirect. This allows the attacker to redirect users to arbitrary external websites, potentially enabling phishing attacks or other forms of user manipulation.

Statement: This MODERATE impact vulnerability in Gradio's OAuth flow allows for open redirection due to an unvalidated `_target_url` query parameter. Red Hat products utilizing Gradio with OAuth enabled, such as the `ansible-chatbot-service`, may be affected if running vulnerable versions. Exploitation requires user interaction with the `/logout` or `/login/callback` endpoints.

Remediation:
io_uring/rw: free potentially allocated iovec on cache put failure
CVE: CVE-2026-23259
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component
CVE: CVE-2026-2801
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:29.929000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the JavaScript: WebAssembly component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
libpng: Heap-based buffer overflow in pnm2png allows information disclosure and denial of service
CVE: CVE-2026-3713
Component: libpng
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-03-08T06:02:11.204000+00:00

A flaw was found in libpng. A local attacker could exploit this vulnerability by manipulating the width/height arguments in the `do_pnm2png` function of the `pnm2png` component. This manipulation causes a heap-based buffer overflow, which could lead to information disclosure and denial of service (DoS).

Statement: This MODERATE impact heap-based buffer overflow in the `pnm2png` utility of libpng requires local execution to exploit. Red Hat products are affected if they process untrusted image data using the `pnm2png` utility.

Remediation:
To mitigate this vulnerability, avoid processing untrusted image data with the `pnm2png` utility. Restrict execution of `pnm2png` to trusted users and ensure that only trusted image files are processed.
PJSIP: Denial of Service via malformed RTP payload processing
CVE: CVE-2026-29068
Component: PJSIP
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-06T06:36:45.790000+00:00

A flaw was found in PJSIP. A remote attacker could exploit a stack buffer overflow vulnerability in the pjmedia-codec component. This occurs when the component processes a Real-time Transport Protocol (RTP) payload that contains more frames than it is designed to handle. Successful exploitation of this vulnerability could lead to a Denial of Service (DoS), making the affected system unavailable.

Statement: IMPORTANT: A stack buffer overflow flaw exists in the PJSIP library's Opus codec parser. This vulnerability occurs when processing specially crafted RTP payloads containing more frames than the allocated buffer can hold, potentially leading to denial of service or arbitrary code execution in applications utilizing PJSIP for Opus codec handling.

Remediation:
Black: Arbitrary file writes from unsanitized user input in cache file name
CVE: CVE-2026-32274
Component: black
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-12T19:47:07.464000+00:00

A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
CVE: CVE-2026-23035
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv

mlx5e_priv is an unstable structure that can be memset(0) if profile
attaching fails.

Pass netdev to mlx5e_destroy_netdev() to guarantee it will work on a
valid netdev.

On mlx5e_remove: Check validity of priv->profile, before attempting
to cleanup any resources that might be not there.

This fixes a kernel oops in mlx5e_remove when switchdev mode fails due
to change profile failure.

$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev
Error: mlx5_core: Failed setting eswitch to offloads.
dmesg:
workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR
mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12
mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12
workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR
mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12
mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12

$ devlink dev reload pci/0000:00:03.0 ==> oops

BUG: kernel NULL pointer dereference, address: 0000000000000370
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
RIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100
RSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286
RAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0
RBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10
R10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0
R13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400
FS:  00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0
Call Trace:
 <TASK>
 mlx5e_remove+0x57/0x110
 device_release_driver_internal+0x19c/0x200
 bus_remove_device+0xc6/0x130
 device_del+0x160/0x3d0
 ? devl_param_driverinit_value_get+0x2d/0x90
 mlx5_detach_device+0x89/0xe0
 mlx5_unload_one_devl_locked+0x3a/0x70
 mlx5_devlink_reload_down+0xc8/0x220
 devlink_reload+0x7d/0x260
 devlink_nl_reload_doit+0x45b/0x5a0
 genl_family_rcv_msg_doit+0xe8/0x140


Remediation:
Argo Workflows has unauthorized access to Argo Workflows Template
CVE: CVE-2026-28229
Component: argo-workflows
CWE: CWE-306
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-11T15:37:47.338000+00:00

A flaw was found in Argo Workflows in which an attacker can leak sensitive information contained in Workflow Templates and Cluster Workflow Templates. Because the functions that retrieve template information use server permissions, no authorization is required to read templates which might contain secrets such as passwords, API keys, or other sensitive data.


Remediation:
Strimzi: Improper certificate validation allows unauthorized access via CA chain misconfiguration
CVE: CVE-2026-27133
Component: strimzi-kafka-operator
CWE: CWE-295
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-20T22:38:27.721000+00:00

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificates configuration of a Kafka Connect operand or of the target cluster in the Kafka MirrorMaker 2 operand, all of the certificates that are part of the CA chain will be trusted individually when connecting to the Apache Kafka cluster. Due to this error, the affected operand (Kafka Connect or Kafka MirrorMaker 2) might accept connections to Kafka brokers using server certificates signed by one of the other CAs in the CA chain and not just by the last CA in the chain. This issue is fixed in Strimzi 0.50.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Jenkins: Stored Cross-site Scripting (XSS) via unescaped user-provided offline cause description
CVE: CVE-2026-27099
Component: org.jenkins-ci.main/jenkins-core
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.8/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-02-18T14:17:43.911000+00:00

A flaw was found in Jenkins. This vulnerability, identified as a stored cross-site scripting (XSS) issue, occurs because Jenkins does not properly escape the user-provided description for the "Mark temporarily offline" cause. An attacker with Agent/Configure or Agent/Disconnect permissions can exploit this to inject malicious scripts, leading to potential information disclosure or unauthorized actions within the user's browser.

Statement: This vulnerability in Jenkins allows authenticated attackers with Agent/Configure or Agent/Disconnect permissions to inject malicious scripts into the "Mark temporarily offline" cause description. This stored cross-site scripting (XSS) flaw can lead to information disclosure or unauthorized actions within a user's browser when viewing the affected description. Red Hat OpenShift Developer Tools & Services are affected.

Remediation:
c3p0: Arbitrary Code Execution via deserialization of crafted objects
CVE: CVE-2026-27830
Component: c3p0
CWE: CWE-502
Severity: Important
CVSS v3: 8.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-26T00:45:18.222000+00:00

A flaw was found in c3p0, a Java Database Connectivity (JDBC) Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or `javax.naming.Reference` instances. By manipulating the `userOverridesAsString` property, an attacker can cause the application to download and execute malicious code from a remote location on its CLASSPATH.


Remediation:
To apply this update, follow the standard installation procedure for your platform:

* https://docs.redhat.com/en/documentation/red_hat_build_of_debezium/3.2.7/html-single/installing_debezium_on_openshift/index
*
https://docs.redhat.com/en/documentation/red_hat_build_of_debezium/3.2.7/html-single/installing_debezium_on_rhel/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay
CVE: CVE-2026-3085
Component: GStreamer
CWE: CWE-1284
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:40:02.186000+00:00

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the rtpqdm2depay component allows a remote attacker to execute arbitrary code. The flaw occurs due to insufficient validation of user-supplied data length during the processing of X-QDM Real-time Transport Protocol (RTP) payloads. Successful exploitation can lead to remote code execution within the context of the current process.

Statement: This is an IMPORTANT vulnerability in the GStreamer rtpqdm2depay plugin. The flaw enables remote code execution through a heap-based buffer overflow when processing specially crafted X-QDM RTP payloads. Exploitation requires an application to interact with the vulnerable GStreamer library to process such untrusted media streams.

Remediation:
To mitigate this issue, avoid processing X-QDM RTP payloads from untrusted sources. Restricting network access to applications that utilize GStreamer for RTP stream processing can limit exposure.
drm/imx/tve: fix probe device leak
CVE: CVE-2026-23170
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/imx/tve: fix probe device leak

Make sure to drop the reference taken to the DDC device during probe on
probe failure (e.g. probe deferral) and on driver unbind.


Remediation:
NLTK: Arbitrary file read via path traversal vulnerability
CVE: CVE-2026-0847
Component: nltk
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-04T18:25:30.240000+00:00

A flaw was found in NLTK (Natural Language Toolkit). This vulnerability allows a remote attacker to read arbitrary files on the server due to improper sanitization of file paths in several CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. By exploiting this path traversal vulnerability, an attacker can gain unauthorized access to sensitive information, such as system files, SSH private keys, and API tokens. In certain scenarios, this could potentially lead to remote code execution.

Statement: This IMPORTANT path traversal vulnerability affects multiple CorpusReader classes in NLTK versions through 3.9.2. Exploitation is network-accessible and requires no authentication when user-controlled file inputs are processed by applications. Impact is high confidentiality loss through unauthorized access to sensitive system files. Red Hat products using NLTK to handle untrusted file inputs are affected.

Remediation:
AWS-LC: Signature bypass due to improper validation in PKCS7_verify()
CVE: CVE-2026-3338
Component: aws-lc
CWE: CWE-347
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-02T21:22:41.954000+00:00

A flaw was found in AWS-LC. An unauthenticated user can bypass signature verification when processing PKCS7 objects with Authenticated Attributes due to improper signature validation in the PKCS7_verify() function. This vulnerability allows an attacker to potentially compromise the integrity of signed data.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
seroval: Arbitrary Code Execution via Improper JSON Deserialization
CVE: CVE-2026-23737
Component: seroval
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-21T23:09:34.670000+00:00

A flaw was found in seroval, a JavaScript library designed to convert complex data into a string format. This vulnerability exists within the library's JSON deserialization process, which is responsible for converting string data back into usable objects. A remote attacker can exploit improper input handling in the `fromJSON` and `fromCrossJSON` functions to execute arbitrary JavaScript code. Successful exploitation requires the attacker to make multiple specific requests and possess some understanding of how the serialized data is processed, ultimately leading to unauthorized control over the affected system.

Statement: This vulnerability is rated Important for Red Hat. The `seroval` library, used in components like `forgejo` in Fedora and EPEL, is susceptible to remote code execution through improper JSON deserialization. Exploitation requires an attacker to perform multiple requests and possess partial knowledge of how serialized data is processed during runtime.

Remediation:
Vim: Arbitrary code execution via 'helpfile' option processing
CVE: CVE-2026-25749
Component: vim
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-06T22:43:38.630000+00:00

A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the 'helpfile' option. A local user could exploit this by providing a specially crafted 'helpfile' option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.

Statement: This MODERATE impact vulnerability in Vim's tag file resolution logic allows a local attacker to achieve a out-of-bounds write. By providing a specially crafted `helpfile` option value a local user can trigger a heap buffer overflow, as consequence lead to memory corruption presenting a data integrity impact or leading the vim process to crash resulting in availability impact. Although being non-trivial and very complex, arbitrary code execution is not discarded as worst case scenario.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Exiv2: Denial of Service via integer overflow in preview component
CVE: CVE-2026-27631
Component: Exiv2
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-02T19:40:45.351000+00:00

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.

Statement: This LOW impact vulnerability in Exiv2 is triggered only when the command-line utility is executed with the `-pp` argument, which enables the preview component. Exploitation requires explicit user action and is not a default exposure in Red Hat products.

Remediation:
Inappropriate implementation in V8
CVE: CVE-2026-0902
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-01-13T00:00:00+00:00

Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
CVE: CVE-2026-23222
Component: kernel
Severity: None
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly

The existing allocation of scatterlists in omap_crypto_copy_sg_lists()
was allocating an array of scatterlist pointers, not scatterlist objects,
resulting in a 4x too small allocation.

Use sizeof(*new_sg) to get the correct object size.


Remediation: