huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Gradio: Server-Side Request Forgery allows access to internal services via malicious Space loading
CVE: CVE-2026-28416
Component: Gradio
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2026-02-27T21:47:04.975000+00:00

A flaw was found in Gradio, an open-source Python package for rapid prototyping. A remote attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load this attacker-controlled Space, a malicious `proxy_url` from the configuration is trusted. This allows the attacker to make arbitrary HTTP requests from the victim's server, potentially accessing internal services, cloud metadata endpoints, and private networks through the victim's infrastructure.

Statement: This is an IMPORTANT Server-Side Request Forgery (SSRF) vulnerability in Gradio, affecting the `ansible-chatbot-service` within Red Hat Ansible Services. The flaw allows an attacker to make arbitrary HTTP requests from a victim's server by injecting a malicious `proxy_url` when the application uses `gr.load()` to load an attacker-controlled Gradio Space. This could lead to unauthorized access to internal services, cloud metadata, and private networks.

Remediation:
GStreamer: Remote Code Execution via Out-Of-Bounds Write in H.266 Codec Parser
CVE: CVE-2026-3086
Component: GStreamer
CWE: CWE-787
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:40:12.973000+00:00

A flaw was found in GStreamer. A remote attacker could exploit this out-of-bounds write vulnerability by providing specially crafted H.266 video data. This issue, specifically within the processing of Adaptation Parameter Set (APS) units, stems from insufficient validation of user-supplied data, leading to a write beyond the allocated buffer. Successful exploitation allows the attacker to execute arbitrary code on the system where GStreamer is running.

Statement: This vulnerability is rated as IMPORTANT. It affects the GStreamer H.266 Codec Parser, which is included in Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10. Exploitation requires processing specially crafted H.266 media content, which could lead to remote code execution in the context of the current process.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
xgrammar: Denial of Service via multi-level nested syntax
CVE: CVE-2026-25048
Component: xgrammar
CWE: CWE-674
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T15:34:42.095000+00:00

A flaw was found in xgrammar, an open-source library for structured generation. This vulnerability allows an attacker to trigger a segmentation fault, causing the program to crash and resulting in a Denial of Service (DoS). The issue occurs due to improper handling of multi-level nested syntax.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
fast-xml-parser: Denial of Service via XML entity expansion bypass
CVE: CVE-2026-33036
Component: fast-xml-parser
CWE: CWE-776
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T05:17:03.290000+00:00

A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by supplying specially crafted XML input containing numeric character references or standard XML entities. This input can bypass configured entity expansion limits, leading to excessive memory allocation and high CPU usage. The primary consequence is a Denial of Service (DoS), which can crash the affected process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
btrfs: release path before iget_failed() in btrfs_read_locked_inode()
CVE: CVE-2026-23036
Component: kernel
CWE: CWE-821
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

An ABBA deadlock vulnerability was found in the Linux kernel's Btrfs filesystem. When btrfs_read_locked_inode() fails to lookup an inode, it calls iget_failed() while still holding a read-locked btree leaf. Since iget_failed() triggers inode eviction which needs the delayed_node mutex, and delayed inode updates hold the mutex while modifying the btree, a circular lock dependency occurs leading to deadlock.

Statement: This deadlock was discovered by syzbot and affects Btrfs filesystem operations that fail during inode lookup. The lock order violation between btrfs-tree-00 and delayed_node->mutex can cause the system to hang. Triggering requires specific error conditions during inode operations that cause the lookup to fail.

Remediation:
silent TLS certificate verification bypass on HTTPS Redirect via proxy
CVE: CVE-2026-32627
Component: cpp-httplib
CVSS v3: 8.6/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2026-03-13T20:48:14.442000+00:00

A flaw was found in cpp-httplib. When a client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target (expired, self-signed, or forged) without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
bus: fsl-mc: fix use-after-free in driver_override_show()
CVE: CVE-2026-23221
Component: kernel
CWE: CWE-663
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's Freescale Management Complex (fsl-mc) bus driver. The driver_override_show() sysfs function reads the driver_override string without acquiring the device_lock, while driver_override_store() modifies and frees the string while holding the lock. This race condition can result in a use-after-free if the string is freed by a concurrent store operation while being read by the show function.

Statement: This vulnerability affects systems with Freescale/NXP QorIQ DPAA2 hardware using the fsl-mc bus driver. Exploitation requires concurrent sysfs access to the driver_override attribute, typically requiring local access with appropriate permissions. The flaw is specific to embedded and data plane acceleration hardware platforms.

Remediation:
hardlink path traversal via drive-relative linkpath
CVE: CVE-2026-29786
Component: node-tar
CWE: CWE-22
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Release date: 2026-03-07T15:32:22.748000+00:00

A flaw was found in node-tar. A hardlink that points outside the extraction directory can be created by using a drive-relative link target such as C:../target.txt, allowing a file overwrite outside the current working directory during normal tar.x() extraction.

Statement: To exploit this flaw, an attacker must be able to supply a specially crafted archive to be processed by an application using node-tar. Additionally, this vulnerability allows files to be extracted outside the intended directory but it is still limited to the permissions of the node-tar application processing the archive. Due to this reason, this flaw has been rated with an important severity.

This vulnerability does not affect node-tar running on Unix-like systems as it relies on a drive-relative link target to be exploited.

Remediation:
curl: Unauthorized access due to improper HTTP proxy connection reuse
CVE: CVE-2026-3784
Component: curl
CWE: CWE-305
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-11T10:09:21.418000+00:00

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
ImageMagick: Information disclosure via heap buffer over-read when processing images
CVE: CVE-2026-27798
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-02-25T23:18:33.174000+00:00

A flaw was found in ImageMagick. A local user could exploit a heap buffer over-read vulnerability by processing a specially crafted image with small dimensions using the `-wavelet-denoise` operator. This vulnerability may lead to the disclosure of sensitive information.

Statement: This MODERATE impact vulnerability in ImageMagick affects Red Hat Enterprise Linux. A heap buffer over-read can occur when processing images with small dimensions using the `-wavelet-denoise` operator. This flaw could lead to information disclosure or denial of service.

Remediation:
To reduce exposure, avoid processing untrusted or maliciously crafted images with ImageMagick. If processing untrusted content is necessary, consider executing ImageMagick operations within a sandboxed environment to contain potential risks.
Keycloak: Information disclosure of disabled user attributes via administrative endpoint
CVE: CVE-2026-3911
Component: org.keycloak.services.resources.admin.UserResource
CWE: CWE-359
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-11T03:30:00+00:00

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.

Statement: This is a LOW impact flaw in Keycloak where disabled unmanaged user attributes are disclosed. An authenticated user with the `view-users` role can access attributes that are configured to be hidden from both users and administrators, violating the intended privacy settings.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
CVE: CVE-2026-2603
Component: keycloak
CWE: CWE-306
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-05T11:23:00+00:00

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Statement: This important flaw in Red Hat Build of Keycloak allows a remote attacker to bypass security controls. A disabled SAML Identity Provider can still be exploited for unauthorized authentication via IdP-initiated broker logins if the SAML protocol endpoint is reachable and the attacker knows the broker URL.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-0794
Component: ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability
Release date: 2026-01-09T15:56:02.717000+00:00

ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of SIP calls. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28303.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Flare: Information disclosure via inconsistent access checks for private files
CVE: CVE-2026-30231
Component: flare
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-06T21:10:41.969000+00:00

A flaw was found in Flare, a self-hostable file sharing platform. An authenticated user, who is not the owner of a private file, can access and retrieve the content of that file by knowing its URL and using the raw and direct file routes. This is due to inconsistent access control checks compared to other endpoints, leading to unauthorized information disclosure.

Statement: This MODERATE vulnerability in Flare allows authenticated users to retrieve private files owned by others via raw and direct file routes. These endpoints only check for authentication, not ownership, creating an authorization bypass. Impact is high confidentiality loss since full file contents are exposed, but requires valid authentication and knowledge of the file URL.

Remediation:
GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker
CVE: CVE-2026-3442
Component: binutils
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Release date: 2026-03-02T11:11:00+00:00

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service.

Statement: This MODERATE flaw in GNU Binutils (bfd linker) requires an attacker to trick a user into running the `ld` linker against a specially crafted malicious XCOFF object file. This could lead to an out-of-bounds read.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SAMtools: Denial of Service due to NULL pointer dereference in cram-size command
CVE: CVE-2026-31973
Component: samtools
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T20:34:00.846000+00:00

A flaw was found in SAMtools. In the `cram-size` command, a missing check for the return value of the `cram_decode_compression_header()` function can lead to a NULL pointer dereference. An attacker could exploit this by providing a specially crafted CRAM file. This vulnerability typically causes the program to crash, resulting in a Denial of Service (DoS).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
CVE: CVE-2026-23108
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A memory leak vulnerability was found in the Linux kernel's USB 8devices CAN adapter driver. The URBs allocated for USB-in transfers are unanchored by the USB framework before the completion callback is invoked. Since usb_8dev_read_bulk_callback() does not re-anchor the URBs, they are never freed when usb_kill_anchored_urbs() is called during device close, causing a memory leak on each open/close cycle.

Statement: This is primarily a resource management bug. Consider operational risk higher on systems with frequent connect disconnect or high CAN traffic because leaks accumulate over time.

Remediation:
To mitigate this issue, prevent the usb_8dev module from being loaded if USB 8devices CAN adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
Insufficient policy enforcement in Frames
CVE: CVE-2026-2316
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-10T00:00:00+00:00

Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
net: add xmit recursion limit to tunnel xmit functions
CVE: CVE-2026-23276
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel. When a bond device in broadcast mode has Generic Routing Encapsulation (GRE) tap interfaces configured as slaves, and these GRE tunnels are routed back through the bond, multicast or broadcast network traffic can trigger an infinite recursion. This recursion occurs within the kernel's tunnel transmit functions, leading to a kernel stack overflow. A local attacker could potentially exploit this to cause a Denial of Service (DoS) on the system.

Statement: This vulnerability requires a specific network configuration: a bonding device in broadcast mode with GRE tap tunnel slaves where the tunnels route back through the bond. When multicast or broadcast traffic is sent, the lack of recursion limits in tunnel transmit functions causes infinite recursion between bond_xmit_broadcast() and tunnel xmit functions, exhausting the kernel stack. This affects GRE, VXLAN, Geneve, and similar tunnels.

Remediation:
Avoid configuring bond devices in broadcast mode with tunnel interfaces (GRE, VXLAN, Geneve) as slaves when those tunnels route back through the bond. Alternatively, use a different bonding mode such as active-backup or 802.3ad.
Use after free in WebRTC
CVE: CVE-2026-4446
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An use after free flaw was found in the WebRTC component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=486421954

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
.NET: Privilege escalation via incorrect default permissions
CVE: CVE-2026-26131
Component: dotnet
CWE: CWE-276
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-10T17:05:09.057000+00:00

A flaw was found in .NET. Incorrect default permissions allow an authorized local attacker to exploit this vulnerability. This can lead to local privilege escalation, enabling the attacker to gain higher access rights on the system.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
DOMPurify: Cross-site scripting vulnerability
CVE: CVE-2026-0540
Component: DOMPurify
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-03-03T17:26:06.621000+00:00

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 729097f, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Traefik: Denial of Service due to unbounded ForwardAuth middleware response processing
CVE: CVE-2026-26998
Component: github.com/traefik/traefik
CWE: CWE-770
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T16:15:05.653000+00:00

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This results in a denial of service for all routes served by the affected Traefik instance. This issue has been patched in versions 2.11.38 and 3.6.9.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.