huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Calibre: Remote Code Execution via Path Traversal
CVE: CVE-2026-26064
Component: calibre
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T01:44:34.137000+00:00

A flaw was found in calibre. This vulnerability, known as a path traversal, allows an attacker to write files to unintended locations on a user's system. This occurs because a function responsible for extracting pictures does not properly handle special characters in file paths.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Next.js: HTTP request smuggling in rewrites
CVE: CVE-2026-29057
Component: next.js
CWE: CWE-444
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-18T00:30:27.738000+00:00

A request smuggling flaw has been discovered in Next.js.  when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
minisat: Denial of Service due to out-of-bounds read
CVE: CVE-2026-2644
Component: minisat
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-18T07:02:06.761000+00:00

A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the component DIMACS File Parser. This manipulation of the argument variable index with the input 2147483648 causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in WebAudio
CVE: CVE-2026-3540
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()
CVE: CVE-2026-23231
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-04T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with CAP_NET_ADMIN capabilities, or remote packet traffic, could exploit a use-after-free vulnerability in the nf_tables_addchain() function's error handling. Successful exploitation could lead to a kernel crash, resulting in a Denial of Service (DoS), or potentially privilege escalation.

Statement: A use after free can occur in nf_tables_addchain error handling because a new chain is published to table chains via RCU before hook registration completes and is then freed without an RCU grace period when hook registration fails. This creates a race with RCU readers in the control plane such as nf_tables_dump_chains and also with in flight packet evaluation when an IPv4 hook is transiently installed for NFPROTO_INET and later IPv6 hook registration fails. For the CVSS the PR is L because a local actor with CAP_NET_ADMIN can induce the failing add chain path while remote packet traffic may hit the transient hook and trigger the UAF window. Impact ranges from a kernel crash to potential privilege escalation.

Remediation:
In order to trigger the issue, it requires the ability to create user/net namespaces.

On non-containerized deployments of Red Hat Enterprise Linux 8, it is recommended to disable user namespaces by setting user.max_user_namespaces to 0:

# echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
# sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.
OpenEXR: Arbitrary code execution via integer overflow in EXR file processing
CVE: CVE-2026-27622
Component: openexr
CWE: CWE-190
Severity: Important
CVSS v3: 7.3/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-03T22:42:49.086000+00:00

A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An attacker can craft a malicious EXR file that, when processed, causes an integer overflow in the `CompositeDeepScanLine::readPixels` function. This overflow leads to an undersized buffer allocation, which can then be overrun during write operations. Successful exploitation could result in arbitrary code execution or a denial of service (DoS).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mackron / dr_libs Excessive Memory Allocation in PICTURE Metadata Parsing
CVE: CVE-2026-32836
Component: dr_libs
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-17T19:10:19.404000+00:00

An uncontrolled memory allocation vulnerability has been discovered in the dr_libs library. The `drflac__read_and_decode_metadata()` function allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-2490
Component: RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability
Release date: 2026-02-19T14:20:43.256000+00:00

RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Janet-lang: Denial of Service due to out-of-bounds read
CVE: CVE-2026-2869
Component: janet-lang
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-21T14:32:08.938000+00:00

A flaw was found in janet-lang. A local user can exploit this vulnerability by manipulating the `janetc_varset` function, located in `src/core/specials.c`, which leads to an out-of-bounds read. This issue can result in a Denial of Service (DoS) for the affected system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vips: libvips: Memory corruption vulnerability via argument index manipulation in vips_bandrank_build
CVE: CVE-2026-3281
Component: libvips
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-27T02:02:10.922000+00:00

A flaw was found in libvips. A local attacker can exploit a heap-based buffer overflow vulnerability by manipulating the argument index in the `vips_bandrank_build` function. This can lead to information disclosure, data modification, or denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer out-of-bounds read in VMDK compressed grain parsing
CVE: CVE-2026-2243
Component: qemu-kvm
CWE: CWE-125
Severity: Low
CVSS v3: 5.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-02-10T00:00:00+00:00

A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).


Remediation:
CVE: CVE-2026-0784
Component: ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:54:45.230000+00:00

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28293.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTSlib: Arbitrary code execution via crafted CRAM file
CVE: CVE-2026-31963
Component: htslib
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T18:22:58.440000+00:00

A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. When processing CRAM (Compressed Reference-oriented Alignment Map) files, an out-by-one error in feature decoding can cause a heap buffer overflow. This vulnerability allows an attacker to craft a malicious CRAM file which, when opened by a user, could lead to a program crash, data corruption, or potentially arbitrary code execution.

Statement: This is an IMPORTANT flaw due to a heap buffer overflow in the HTSlib CRAM reader when processing specially crafted CRAM files. This flaw requires user interaction, as it is triggered when an application linked against HTSlib opens a malicious CRAM file, potentially leading to arbitrary code execution or data corruption.

Remediation:
pypdf: Denial of Service due to excessive memory consumption via crafted PDF
CVE: CVE-2026-31826
Component: pypdf
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-10T21:36:52.186000+00:00

A flaw was found in pypdf, a pure-Python PDF library. An attacker can craft a malicious PDF file containing a content stream with an intentionally large /Length value. When this PDF is parsed, it can lead to excessive memory consumption, resulting in a Denial of Service (DoS) condition due to resource exhaustion.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
rxrpc: Fix data-race warning and potential load/store tearing
CVE: CVE-2026-23118
Component: kernel
CWE: CWE-820
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A data race flaw was found in the Linux kernel's RxRPC protocol implementation. The last_tx_at field is accessed without proper synchronization between rxrpc_peer_keepalive_worker() and rxrpc_send_data_packet(). Additionally, on 32-bit architectures, the 64-bit last_tx_at value can experience load/store tearing. The fix changes the field to an unsigned int to prevent tearing and silence the KCSAN warning.

Statement: The data race has minimal practical impact as the last_tx_at value is only used for approximate keepalive timing decisions, not security-critical operations. An incorrect read would at worst cause a slightly early or late keepalive packet. The fix primarily addresses KCSAN warnings and theoretical tearing on 32-bit systems.

Remediation:
libvips: Heap-based buffer overflow
CVE: CVE-2026-3147
Component: libvips
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-25T03:32:09.025000+00:00

A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3ab458a25e0e261cbd1788474bbc763f7435780. It is advisable to implement a patch to correct this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
@modelcontextprotocol/sdk cross-client data leak
CVE: CVE-2026-25536
Component: @modelcontextprotocol/sdk
CWE: CWE-367
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2026-02-04T21:29:38.276000+00:00

A data leak by way of a race condition has been discovered in the @modelcontextprotocol/sdk npm library. The cross-client response data leak exists when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. When two or more MCP clients send requests concurrently through a shared server instance, JSON-RPC message ID collisions cause responses to be routed to the wrong client's HTTP connection. Client A can receive response data intended for Client B, and vice versa, even when authorization was correctly enforced on each individual request.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
janet-lang: Denial of Service via out-of-bounds read
CVE: CVE-2026-2242
Component: janet-lang
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T17:02:09.705000+00:00

A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0785
Component: ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:54:52.416000+00:00

ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the API interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28294.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer overflow in inflate() in zlib module (CVE-2022-37434)
CVE: CVE-2026-24799
Component: dlib
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-27T08:31:36.371000+00:00

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
htslib: Heap buffer overflow leading to arbitrary code execution via crafted CRAM file
CVE: CVE-2026-31962
Component: htslib
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T18:08:26.067000+00:00

A flaw was found in htslib, a library for reading and writing bioinformatics file formats. A local user could exploit a heap buffer overflow vulnerability by opening a specially crafted CRAM file. This flaw occurs due to incorrect handling of certain CRAM format records, leading to reading and writing a single byte beyond a heap allocation. Successful exploitation could result in a program crash, data corruption, or potentially arbitrary code execution.

Statement: This is an IMPORTANT heap buffer overflow flaw in the HTSlib CRAM reader. The vulnerability can be triggered when processing a specially crafted CRAM file, potentially leading to application crashes, data corruption, or arbitrary code execution. This issue affects Red Hat Community Projects, including EPEL and Fedora.

Remediation:
bonding: provide a net pointer to __skb_flow_dissect()
CVE: CVE-2026-23119
Component: kernel
CWE: CWE-166
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's network bonding driver. When performing XDP redirect operations through a bonding interface, the bond_flow_dissect() function fails to provide a network namespace pointer to __skb_flow_dissect(). This triggers a kernel warning when processing packets with incomplete socket buffer metadata, potentially indicating improper state handling.

Statement: Triggering this flaw requires BPF capabilities (CAP_BPF or CAP_SYS_ADMIN) to run XDP programs via the bpf() syscall test interface. The impact is limited to a kernel warning rather than a crash or memory corruption, reducing the severity of this issue.

Remediation:
libvips: Local denial of service due to null pointer dereference
CVE: CVE-2026-3146
Component: libvips
CVSS v3: 2.9/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T03:02:09.172000+00:00

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
jsonwebtoken has Type Confusion that leads to potential authorization bypass
CVE: CVE-2026-25537
Component: jsonwebtoken
CWE: CWE-843
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-04T21:31:53.511000+00:00

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0.

Statement: MODERATE impact: A type confusion flaw in the `jsonwebtoken` library allows attackers to bypass time-based security restrictions, such as "Not Before" checks, by providing malformed JSON types for standard claims. This can lead to authentication and authorization bypasses in applications utilizing the affected library, including Red Hat Ansible Automation Platform, Red Hat OpenShift AI, and Confidential Compute Attestation.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component
CVE: CVE-2026-2757
Component: firefox
Severity: Important
CVSS v3: 7.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2026-02-24T13:32:57.740000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the WebRTC: Audio/Video component.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation: