huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Memory allocation with excessive without limits in the internal SVG decoder
CVE: CVE-2026-25985
Component: ImageMagick
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T01:43:07.076000+00:00

A memory exhaustion vulnerability has been identified in ImageMagick when processing specially crafted SVG image files. In vulnerable versions, a maliciously crafted SVG element may trigger an excessively large internal memory allocation (on the order of hundreds of gigabytes), causing the ImageMagick process to consume all available memory and abort. An application that reads, identifies, or converts such an SVG image may be affected when the file is passed to ImageMagick’s API or command-line tools.

Statement: This issue is classified as High severity by Red Hat Product Security. A remote attacker can craft an SVG image that, when processed by ImageMagick, induces extremely large memory allocation requests, leading to process failure or termination. The attack complexity is low and does not require any privileges or user interaction. While confidentiality and integrity are not directly impacted, the availability of services that parse or manipulate untrusted SVG images could be significantly disrupted over network, justifying a High severity rating.

```

It is important to note that ImageMagick has been removed from Red Hat Enterprise Linux 8 and later releases. Therefore, current supported RHEL 8 and newer systems are not affected by this issue unless ImageMagick is installed from third-party or custom repositories.

For additional information, refer to https://access.redhat.com/solutions/4437561.

```

Remediation:
To mitigate this vulnerability, avoid processing untrusted or unverified SVG image files with ImageMagick. When ImageMagick must process SVG files from untrusted sources, consider running the application in a sandboxed environment to limit potential resource exhaustion impacts.
wifi: mac80211: correctly decode TTLM with default link map
CVE: CVE-2026-23152
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: correctly decode TTLM with default link map

TID-To-Link Mapping (TTLM) elements do not contain any link mapping
presence indicator if a default mapping is used and parsing needs to be
skipped.

Note that access points should not explicitly report an advertised TTLM
with a default mapping as that is the implied mapping if the element is
not included, this is even the case when switching back to the default
mapping. However, mac80211 would incorrectly parse the frame and would
also read one byte beyond the end of the element.

Statement: A flaw in mac80211 advertised TID To Link Mapping parsing can lead to an out of bounds read when the TTLM element uses the default link map. With a default mapping the element does not include a link map presence indicator byte. The function ieee80211_parse_adv_t2l previously unconditionally read link_map_presence from the current position and advanced the pointer. When control indicates IEEE80211_TTLM_CONTROL_DEF_LINK_MAP this causes the code to consume a byte that is not part of the element, effectively reading one byte beyond the end of the TTLM data. An attacker in radio range can potentially trigger this by transmitting crafted 802.11 management frames or by operating a malicious access point that advertises malformed TTLM information. No privileges are required on the target. The primary impact is an information disclosure primitive because the kernel reads beyond the intended bounds. The read size is small, but kernel memory disclosure is generally security relevant because it can help bypass mitigations or support further exploitation chains. For the CVSS the PR:N choice is justified because the attacker only needs proximity and the ability to transmit wireless frames. Availability and integrity impacts are not expected from a one byte read in this path.

Remediation:
@langchain/community: Server-Side Request Forgery (SSRF) bypass via redirect manipulation
CVE: CVE-2026-27795
Component: langchain-core
CWE: CWE-918
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-25T17:30:01.106000+00:00

A flaw was found in @langchain/community. The RecursiveUrlLoader component, which is responsible for loading URLs, fails to revalidate URLs after following redirects. This allows an attacker to bypass existing Server-Side Request Forgery (SSRF) protections by initially providing a safe public URL that then redirects to an internal or sensitive metadata endpoint. This could lead to unauthorized information disclosure or access to internal network resources.

Statement: This vulnerability is rated MODERATE and affects Red Hat products that use the `@langchain/community` package, specifically the `RecursiveUrlLoader`. A redirect chaining flaw allows a Server-Side Request Forgery (SSRF) bypass, enabling redirection from a validated public URL to an internal or metadata endpoint without revalidation. This could expose internal resources.

Remediation:
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
CVE: CVE-2026-32597
Component: pyjwt
CWE: CWE-347
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-12T21:41:50.427000+00:00

A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
aws-lc: Certificate validation bypass via improper handling of PKCS7 objects
CVE: CVE-2026-3336
Component: aws-lc
CWE: CWE-295
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-02T21:15:16.709000+00:00

A flaw was found in aws-lc, a cryptographic library. An unauthenticated attacker can exploit improper certificate validation within the `PKCS7_verify()` function. This allows them to bypass the verification process for certificate chains when handling PKCS7 objects that contain multiple digital signers, except for the last one. The primary consequence is a compromise of integrity, as the system may incorrectly trust unverified certificates.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Asterisk: Local file disclosure via unsafe XML parsing
CVE: CVE-2026-23739
Component: Asterisk
CVSS v3: 2.4/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-02-06T16:42:25.816000+00:00

A flaw was found in Asterisk. The `ast_xml_open()` function in `xml.c` processes XML documents using `libxml` with unsafe parsing options, enabling entity expansion and XInclude processing. A remote attacker can exploit this by providing specially crafted XML input, leading to XML External Entity (XXE) or XInclude-based local file disclosure. This vulnerability could allow the attacker to expose sensitive files from the host system.

Statement: This vulnerability has a LOW impact on Red Hat products. Asterisk, as distributed in Community Projects (EPEL 8/9, Fedora), is affected by an XML External Entity (XXE) and XInclude processing flaw. If an attacker can provide untrusted XML input to Asterisk, it may lead to local file disclosure.

Remediation:
Apache Camel LevelDB: Arbitrary code execution via deserialization of untrusted data
CVE: CVE-2026-25747
Component: org.apache.camel/camel-leveldb
CWE: CWE-502
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-23T08:45:45.826000+00:00

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.

The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5

Statement: This vulnerability is rated as IMPORTANT. The Apache Camel LevelDB component is vulnerable to arbitrary code execution through deserialization of untrusted data. An attacker with write access to the LevelDB database files can inject malicious serialized Java objects, leading to code execution within the application's context. This happens because if the Camel-LevelDB class responsible to read the LevelDB aggregation repository makes use from the `java.io.ObjectInputStream` function without applying any kind of validation or class-load restriction.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Ray Dashboard Path Traversal Leading to Local File Disclosure
CVE: CVE-2026-32981
Component: ray
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-17T19:33:50.107000+00:00

A path traversal flaw has been identified in Ray Dashboard in the Ray Pypi package. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Out-of-bounds heap write via integer overflow in sun decoder
CVE: CVE-2026-25897
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-02-24T01:16:15.438000+00:00

A flaw was found in ImageMagick. An integer overflow vulnerability in the sun decoder allows a remote attacker to cause an out-of-bounds heap write by processing a carefully crafted image. This issue primarily affects 32-bit systems and builds, potentially leading to a denial of service.

Statement: This MODERATE impact vulnerability in ImageMagick's sun decoder can lead to an out-of-bounds heap write on 32-bit systems when processing a specially crafted image. Red Hat Enterprise Linux 6 ELS and 7 ELS, which support 32-bit architectures, are potentially affected if ImageMagick is used to process untrusted image files.

Remediation:
To mitigate this vulnerability, avoid processing untrusted or maliciously crafted image files with ImageMagick on 32-bit systems. Limiting the sources of image files processed by ImageMagick can reduce the risk of exploitation.
wifi: mac80211_hwsim: fix typo in frequency notification
CVE: CVE-2026-23040
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.8/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: fix typo in frequency notification

The NAN notification is for 5745 MHz which corresponds to channel 149
and not 5475 which is not actually a valid channel. This could result in
a NULL pointer dereference in cfg80211_next_nan_dw_notif.

Statement: The mac80211_hwsim virtual WiFi driver contains an incorrect frequency constant used when generating NAN discovery window notifications on the 5 GHz band that can lead to Null pointer deref. In mac80211_hwsim_nan_dw_start the driver calls ieee80211_get_channel with 5475 MHz when nan_curr_dw_band is NL80211_BAND_5GHZ. That frequency does not correspond to a valid channel in typical wiphy channel tables so ieee80211_get_channel may return NULL. Subsequent NAN notification processing in cfg80211 may then dereference the channel pointer and crash the kernel in cfg80211_next_nan_dw_notif leading to a denial of service. The issue is most relevant in test and simulation environments where mac80211_hwsim is loaded and NAN simulation is enabled. A local attacker with permissions to configure wireless interfaces and NAN behavior can trigger the faulty path by enabling NAN simulation and causing 5 GHz NAN discovery window scheduling.

Remediation:
To mitigate this issue, prevent module mac80211_hwsim from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
CVE: CVE-2026-0776
Component: Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Release date: 2026-01-09T16:50:36.139000+00:00

Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation
CVE: CVE-2026-23105
Component: kernel
CWE: CWE-664
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's Quick Fair Queuing (QFQ) scheduler. The QFQ class deactivation logic incorrectly relies on a child qdisc's queue length (qlen) to determine if a class is active. A local user with `CAP_NET_ADMIN` capabilities can manipulate the child qlen into an unexpected state. This manipulation can destabilize the scheduling behavior, leading to traffic disruption or a Denial of Service (DoS) in the networking stack.

Statement: QFQ class deactivation logic used a child qdisc qlen check to decide whether a class is active. If a child qlen can be manipulated into an unexpected state then QFQ may deactivate or keep a class in an inconsistent way which can destabilize scheduling behavior. This can lead to traffic disruption or a denial of service through scheduler inconsistency rather than memory corruption. For the CVSS the PR is L in the paranoid rating because CAP_NET_ADMIN can be delegated in some environments and it is sufficient to create and modify qdiscs. The issue is not directly network reachable because it requires local control plane configuration of traffic control objects. Impact is primarily denial of service in the networking stack and not a confidentiality or integrity breach.

Remediation:
unauthenticated configuration secrets exposure
CVE: CVE-2026-30928
Component: glances
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-10T16:15:37.335000+00:00

A flaw was found in glances. The /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incorrect parsing of IPv6 host literals in net/url
CVE: CVE-2026-25679
Component: net/url
CWE: CWE-1286
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-06T21:28:14.211000+00:00

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.


Remediation:
For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
CVE: CVE-2026-23257
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14
CVE: CVE-2026-2360
Component: postgresql16-anonymizer
CVSS v3: 7.7/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-11T17:47:55.737000+00:00

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved if a superuser adds a new schema in her/his own search_path and grants the CREATE privilege on that schema to untrusted users, both actions being clearly discouraged by the PostgreSQL documentation. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
TimescaleDB: Arbitrary code execution via malicious functions in user-writable schemas during extension upgrade
CVE: CVE-2026-29089
Component: timescaledb
CVSS v3: 8.5/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-03-06T17:06:34.486000+00:00

A flaw was found in TimescaleDB, a time-series database extension for PostgreSQL. A malicious user can exploit this vulnerability by creating functions in user-writable schemas that shadow built-in PostgreSQL functions. During an extension upgrade, PostgreSQL's `search_path` setting, which determines how database objects are located, can cause these malicious functions to be executed instead of the legitimate ones. This can lead to arbitrary code execution, allowing the attacker to run unauthorized commands on the system.

Statement: This IMPORTANT vulnerability affects TimescaleDB versions 2.23.0 through 2.25.1. A database user with low privileges can achieve arbitrary code execution during extension upgrade by placing malicious functions in user-writable schemas. The scope is changed as code executes in the upgrade context with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability.

Remediation:
org.keycloak/keycloak-services: Keycloak: Privilege escalation via manage-clients permission
CVE: CVE-2026-3121
Component: keycloak
CWE: CWE-266
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-24T11:11:00+00:00

No description is available for this CVE.

Statement: This issue was rated MODERATE. A privilege escalation flaw exists in Keycloak where an administrator with `manage-clients` permission can escalate privileges if "Admin Permissions" are enabled at the realm level.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ALSA: aloop: Fix racy access at PCM trigger
CVE: CVE-2026-23191
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: aloop: Fix racy access at PCM trigger

The PCM trigger callback of aloop driver tries to check the PCM state
and stop the stream of the tied substream in the corresponding cable.
Since both check and stop operations are performed outside the cable
lock, this may result in UAF when a program attempts to trigger
frequently while opening/closing the tied stream, as spotted by
fuzzers.

For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with
  cable->lock spinlock, and add the proper NULL checks.  This avoids
  already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream
  that may be stopped in this function, which was the major pain point
  leading to UAF.


Remediation:
Rizin: Heap overflow allows arbitrary code execution via malicious mach0 file
CVE: CVE-2026-22780
Component: Rizin
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-02-02T20:52:23.859000+00:00

A flaw was found in Rizin, a UNIX-like reverse engineering framework. This heap overflow vulnerability can be exploited when a user parses a malicious mach0 file that contains specially crafted entries for the dynamic linker (dyld) chained segments. Successful exploitation could allow a remote attacker to achieve arbitrary code execution or cause a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: