huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Kibana: Cross-site scripting (XSS) via improper input neutralization in Vega AST evaluator
CVE: CVE-2025-68387
Component: Kibana
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-12-18T22:11:39.034000+00:00

A flaw was found in Kibana. An unauthenticated user can embed a malicious script in web page content through improper input neutralization during web page generation. This cross-site scripting (XSS) vulnerability, specifically in a function handler within the Vega AST evaluator, allows for the execution of arbitrary scripts in a victim's browser, potentially leading to information disclosure or unauthorized actions.

Statement: This vulnerability is rated Moderate for Red Hat because it is a cross-site scripting (XSS) flaw in Kibana's Vega AST evaluator that requires user interaction for exploitation. An unauthenticated attacker can embed malicious scripts in web page content, which would then execute in a victim's browser when they view the crafted content. This affects components like `openshift-logging/kibana6-rhel8` in OpenShift Container Platform.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE: CVE-2025-12488
Component: oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability
Release date: 2025-10-30T21:03:26.462000+00:00

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the trust_remote_code parameter provided to the load endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account.
. Was ZDI-CAN-26680.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Kernel: Denial of Service in md driver via uninitialized bioset
CVE: CVE-2025-68368
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Multiple Device (md) driver. A local user can exploit this vulnerability by performing specific operations on `mdadm` (Multiple Device Administration) and `sysfs` (a virtual filesystem providing an interface to kernel data structures). This can lead to a NULL pointer dereference because the `bioset` is not properly initialized before I/O operations, resulting in a system crash and a Denial of Service (DoS).


Remediation:
io_uring/poll: correctly handle io_poll_add() return value on update
CVE: CVE-2025-71149
Component: kernel
CWE: CWE-393
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A logic flaw was found in the Linux kernel's io_uring poll handling. When using POLL_REMOVE to update events on a pending POLL_ADD request, if the update causes the poll to trigger, the completion queue entry (CQE) is lost and never posted to userspace. Additionally, successful completions are incorrectly overwritten with -ECANCELED, causing applications to receive wrong status codes.

Statement: This bug affects applications using io_uring's poll update functionality. Lost completions can cause applications to hang waiting for events that will never be delivered, while incorrect error codes can cause spurious failure handling. The impact is application-level denial of service or incorrect behavior rather than kernel-level security issues.

Remediation:
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
CVE: CVE-2025-39737
Component: kernel
CWE: CWE-1050
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()

A soft lockup warning was observed on a relative small system x86-64
system with 16 GB of memory when running a debug kernel with kmemleak
enabled.

  watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134]

The test system was running a workload with hot unplug happening in
parallel.  Then kemleak decided to disable itself due to its inability to
allocate more kmemleak objects.  The debug kernel has its
CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000.

The soft lockup happened in kmemleak_do_cleanup() when the existing
kmemleak objects were being removed and deleted one-by-one in a loop via a
workqueue.  In this particular case, there are at least 40,000 objects
that need to be processed and given the slowness of a debug kernel and the
fact that a raw_spinlock has to be acquired and released in
__delete_object(), it could take a while to properly handle all these
objects.

As kmemleak has been disabled in this case, the object removal and
deletion process can be further optimized as locking isn't really needed. 
However, it is probably not worth the effort to optimize for such an edge
case that should rarely happen.  So the simple solution is to call
cond_resched() at periodic interval in the iteration loop to avoid soft
lockup.


Remediation:
wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
CVE: CVE-2025-68738
Component: kernel
Severity: Moderate
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()

If a link does not have an assigned channel yet, mt7996_vif_link returns
NULL. We still need to store the updated queue settings in that case, and
apply them later.
Move the location of the queue params to within struct mt7996_vif_link.


Remediation:
WordPress Cross Site Scripting (XSS)
CVE: CVE-2025-58674
Component: wordpress
CVSS v3: 5.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Release date: 2025-09-23T18:47:02.628000+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service in stmmac network driver due to division by zero during PTP timestamping configuration
CVE: CVE-2025-38126
Component: kernel
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping

The stmmac platform drivers that do not open-code the clk_ptp_rate value
after having retrieved the default one from the device-tree can end up
with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will
eventually propagate up to PTP initialization when bringing up the
interface, leading to a divide by 0:

 Division by zero in kernel.
 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22
 Hardware name: STM32 (Device Tree Support)
 Call trace:
  unwind_backtrace from show_stack+0x18/0x1c
  show_stack from dump_stack_lvl+0x6c/0x8c
  dump_stack_lvl from Ldiv0_64+0x8/0x18
  Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4
  stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c
  stmmac_hw_setup from __stmmac_open+0x18c/0x434
  __stmmac_open from stmmac_open+0x3c/0xbc
  stmmac_open from __dev_open+0xf4/0x1ac
  __dev_open from __dev_change_flags+0x1cc/0x224
  __dev_change_flags from dev_change_flags+0x24/0x60
  dev_change_flags from ip_auto_config+0x2e8/0x11a0
  ip_auto_config from do_one_initcall+0x84/0x33c
  do_one_initcall from kernel_init_freeable+0x1b8/0x214
  kernel_init_freeable from kernel_init+0x24/0x140
  kernel_init from ret_from_fork+0x14/0x28
 Exception stack(0xe0815fb0 to 0xe0815ff8)

Prevent this division by 0 by adding an explicit check and error log
about the actual issue. While at it, remove the same check from
stmmac_ptp_register, which then becomes duplicate


Remediation:
Apache Commons OGNL: Expression Injection leading to RCE
CVE: CVE-2025-53192
Component: ognl/ognl
CWE: CWE-146
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-08-18T20:09:31.206000+00:00

An expression injection flaw has been discovered in the Apache Commons OGNL library. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and achieve arbitrary code execution.

Statement: On Red Hat systems the availability impact of this vulnerability is limited. The host operating system is not at risk of any availability impact.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
CVE: CVE-2025-21757
Component: kernel
Severity: None
Release date: 2025-02-27T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels

dst_cache_get() gives us a reference, we need to release it.

Discovered by the ioam6.sh test, kmemleak was recently fixed
to catch per-cpu memory leaks.

Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2025032455-REJECTED-9f08@gregkh/

No Red Hat products are affected by this vulnerability.

Remediation:
CVE: CVE-2025-14419
Component: pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-12-11T20:36:22.472000+00:00

pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27902.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
powerpc/eeh: Make EEH driver device hotplug safe
CVE: CVE-2025-38576
Component: kernel
CWE: CWE-366
Severity: Low
CVSS v3: 4.3/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/eeh: Make EEH driver device hotplug safe

Multiple race conditions existed between the PCIe hotplug driver and the
EEH driver, leading to a variety of kernel oopses of the same general
nature:

<pcie device unplug>
<eeh driver trigger>
<hotplug removal trigger>
<pcie tree reconfiguration>
<eeh recovery next step>
<oops in EEH driver bus iteration loop>

A second class of oops is also seen when the underlying bus disappears
during device recovery.

Refactor the EEH module to be PCI rescan and remove safe.  Also clean
up a few minor formatting / readability issues.


Remediation:
Address bar spoofing using an invalid protocol scheme on Firefox for Android
CVE: CVE-2025-0246
Component: firefox
CWE: CWE-451
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-01-07T16:07:05.551000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory: When using an invalid protocol scheme, an attacker could spoof the address bar. Note: This issue is different than CVE-2025-0244.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. This issue only affects Android operating systems. Other operating systems are unaffected.

Remediation:
can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
CVE: CVE-2025-39873
Component: kernel
Severity: None
Release date: 2025-09-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB

can_put_echo_skb() takes ownership of the SKB and it may be freed
during or after the call.

However, xilinx_can xcan_write_frame() keeps using SKB after the call.

Fix that by only calling can_put_echo_skb() after the code is done
touching the SKB.

The tx_lock is held for the entire xcan_write_frame() execution and
also on the can_get_echo_skb() side so the order of operations does not
matter.

An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb
memory") did not move the can_put_echo_skb() call far enough.

[mkl: add "commit" in front of sha1 in patch description]
[mkl: fix indention]


Remediation:
End-of-Life Node.js Versions Pose Security Risks 17.x or prior
CVE: CVE-2025-23087
Component: node.js
CWE: CWE-1104
Severity: None
Release date: 2025-01-22T01:11:30.821000+00:00

A flaw was found in Node.js. This vulnerability allows potential exposure to unaddressed software vulnerabilities via the continued use of End-of-Life (EOL) versions that no longer receive security updates or patches.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
NULL pointer dereference in the ModuleState::setup function
CVE: CVE-2025-50950
Component: audiofile
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-23T00:00:00+00:00

A flaw was found in the Audiofile library. Processing a specially crafted input file can trigger a NULL pointer dereference, causing a crash to the application linked to the library and resulting in a denial of service.

Statement: To exploit this issue, an attacker needs to be able to process a specially crafted input file with the application linked to the Audiofile library. Additionally, the only security impact of this vulnerability is a denial of service. Due to these reasons, this flaw has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Nextcloud: Cross-site scripting (XSS) in PDF viewer allows arbitrary JavaScript execution
CVE: CVE-2025-59788
Component: Nextcloud
CVSS v3: 6.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2025-12-04T00:00:00+00:00

A flaw was found in Nextcloud's PDF (Portable Document Format) viewer. This vulnerability allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html in the files_pdfviewer example directory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
MySQL Server: Unauthorized Data Modification and Read Access Vulnerability
CVE: CVE-2025-21540
Component: mysql
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-01-21T20:53:12.277000+00:00

A flaw was found in MySQL Server. This vulnerability allows a low privileged attacker with network access via multiple protocols to achieve unauthorized data modification and read access to a subset of MySQL Server's accessible data.


Remediation:
net: dlink: handle copy_thresh allocation failure
CVE: CVE-2025-40053
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: dlink: handle copy_thresh allocation failure

The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
If the allocation failed, dereferencing `skb->protocol` could lead to
a NULL pointer dereference.

This patch tries to allocate `skb`. If the allocation fails, it falls
back to the normal path.

Tested-on: D-Link DGE-550T Rev-A3

Statement: The D-Link dl2k RX path failed to handle netdev_alloc_skb_ip_align() returning NULL. On allocation failure, the code could dereference skb (e.g., skb->protocol), causing a kernel NULL-pointer dereference (DoS).

Remediation:
net: ethernet: cortina: Use TOE/TSO on all TCP
CVE: CVE-2025-38331
Component: kernel
Severity: None
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: cortina: Use TOE/TSO on all TCP

It is desireable to push the hardware accelerator to also
process non-segmented TCP frames: we pass the skb->len
to the "TOE/TSO" offloader and it will handle them.

Without this quirk the driver becomes unstable and lock
up and and crash.

I do not know exactly why, but it is probably due to the
TOE (TCP offload engine) feature that is coupled with the
segmentation feature - it is not possible to turn one
part off and not the other, either both TOE and TSO are
active, or neither of them.

Not having the TOE part active seems detrimental, as if
that hardware feature is not really supposed to be turned
off.

The datasheet says:

  "Based on packet parsing and TCP connection/NAT table
   lookup results, the NetEngine puts the packets
   belonging to the same TCP connection to the same queue
   for the software to process. The NetEngine puts
   incoming packets to the buffer or series of buffers
   for a jumbo packet. With this hardware acceleration,
   IP/TCP header parsing, checksum validation and
   connection lookup are offloaded from the software
   processing."

After numerous tests with the hardware locking up after
something between minutes and hours depending on load
using iperf3 I have concluded this is necessary to stabilize
the hardware.


Remediation:
thunderbird: Incorrect URL stripping in CSP reports
CVE: CVE-2025-8031
Component: firefox
CWE: CWE-276
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-07-22T20:49:26.243000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
The <code>username:password</code> part is incorrectly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
heap-based buffer over-read in gnu_special() in cplus-dem.c
CVE: CVE-2025-66862
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-12-29T00:00:00+00:00

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a heap-based buffer over-read in the gnu_special function in the cplus-dem.c file, causing a crash and resulting in a denial of service.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this heap-based buffer over-read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with cxxfilt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.