huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2026-0782
Component: ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:54:28.842000+00:00

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28291.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Pluggable Auth unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21965
Component: mysql
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
From CVEorg collector
CVE: CVE-2026-0628
Component: chromium
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-01-06T23:57:00.488000+00:00

Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Disabled identity providers are still accepted for JWT Authorization Grant
CVE: CVE-2026-1486
Component: org.keycloak.protocol.oidc.grants
CWE: CWE-358
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-09T18:23:00+00:00

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

Statement: This vulnerability is rated Important for Red Hat products because Keycloak, when configured with JWT authorization grants, fails to verify the enabled status of an Identity Provider (IdP). An attacker possessing the IdP's signing key can issue valid access tokens even if the IdP has been administratively disabled, leading to unauthorized access.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
To mitigate this issue, administrators should immediately revoke or rotate the signing keys associated with any Identity Provider that has been disabled in Keycloak. This operational control is crucial to prevent unauthorized token issuance by ensuring that compromised or offboarded IdP keys cannot be used to generate valid JWT assertions.
libexpat: Denial of Service via NULL pointer dereference after out-of-memory condition
CVE: CVE-2026-32778
Component: libexpat
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-16T07:02:34.410000+00:00

A flaw was found in libexpat. This vulnerability allows an attacker to trigger a NULL pointer dereference in the `setContext` function. This occurs when the system attempts to retry an operation after an out-of-memory condition, which can lead to a Denial of Service (DoS) for the affected application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Linux kernel: Denial of Service in MPTCP due to a race condition
CVE: CVE-2026-23169
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition exists in the mptcp_pm_nl_flush_addrs_doit() function due to improper synchronization when handling network addresses. This flaw could allow a local attacker to trigger system crashes, leading to a Denial of Service (DoS).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
brace-expansion: Denial of Service via unbounded brace range expansion
CVE: CVE-2026-25547
Component: brace-expansion
CWE: CWE-409
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-04T21:51:17.198000+00:00

A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.

Statement: Exploitation of this flaw requires that a user or service processes untrusted input.

Remediation:
vLLM: Remote code execution via invalid image processing in the multimodal endpoint.
CVE: CVE-2026-22778
Component: vLLM
CWE: CWE-209
Severity: Critical
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-02T21:09:53.265000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this vulnerability by sending a specially crafted video URL to vLLM's multimodal endpoint. This action causes vLLM to leak a heap memory address, significantly reducing the effectiveness of Address Space Layout Randomization (ASLR). This information disclosure can then be chained with a heap overflow vulnerability to achieve remote code execution.

Statement: This vulnerability is rated Critical rather than Important because it allows unauthenticated remote code execution without requiring user interaction, ultimately leading to full compromise of the affected system. An attacker can provide a malicious video URL to a vulnerable vLLM inference endpoint, which causes the service to automatically retrieve and process attacker-controlled media content. During decoding, a heap overflow is triggered in the underlying video processing stack, enabling corruption of heap memory and potential overwriting of control structures to execute arbitrary commands on the host. In addition, an information disclosure condition can leak memory addresses, significantly weakening ASLR protections and making exploitation more reliable when combined with the heap overflow. Successful exploitation compromises the confidentiality, integrity, and availability of the system and can impact deployments such as Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, thereby meeting Red Hat’s criteria for Critical severity rather than Important impact.

The vLLM vulnerability depends on CVE-2025-9951, as processing attacker-controlled media can trigger the JPEG2000 decoder heap overflow, which can then be exploited within the vLLM video handling pipeline to cause memory corruption and potentially achieve remote code execution.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()
CVE: CVE-2026-23186
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A deadlock vulnerability was found in the ACPI power meter hwmon driver. The acpi_power_meter_notify() function holds a lock while calling hwmon_device_unregister(), but sysfs attribute callbacks also acquire this lock, creating a circular dependency that can cause system hangs.

Statement: This affects systems with ACPI power meter hardware that receive configuration change notifications from firmware. Triggering the deadlock requires specific firmware events concurrent with sysfs access, which limits practical exploitability to denial of service.

Remediation:
To mitigate this issue, prevent the acpi_power_meter module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module to prevent it from loading automatically.
Spring Data Geode: Path traversal vulnerability allows arbitrary file write via import snapshot functionality.
CVE: CVE-2026-2818
Component: org.springframework.data/spring-data-geode
CWE: CWE-22
Severity: Important
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2026-02-20T16:03:21.032000+00:00

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.


Remediation:
Linux kernel: Denial of service due to a race condition in the TLS subsystem
CVE: CVE-2026-23240
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-03-10T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could exploit a race condition in the TLS (Transport Layer Security) subsystem's `tls_sw_cancel_work_tx()` function. This race condition may allow the system to dereference a freed TLS object, potentially leading to a denial of service.


Remediation:
Wireshark: Denial of Service via HTTP3 protocol dissector infinite loop
CVE: CVE-2026-0960
Component: Wireshark
CWE: CWE-835
Severity: Moderate
CVSS v3: 4.6/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-14T20:23:33.849000+00:00

A flaw was found in Wireshark. A local user could be affected by a denial of service when opening a specially crafted capture file containing HTTP3 protocol traffic. This vulnerability is caused by an infinite loop within the HTTP3 protocol dissector, leading to the application becoming unresponsive.

Statement: This vulnerability is rated Moderate for Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The flaw in the Wireshark HTTP3 protocol dissector can lead to a denial of service when processing a specially crafted HTTP3 packet. This affects systems where Wireshark is used to analyze network traffic, potentially causing the application to become unresponsive.

Remediation:
Users should avoid opening untrusted or suspicious packet capture files with Wireshark. This vulnerability is triggered by processing specially crafted HTTP3 packet captures, which can lead to a denial of service.
Inappropriate implementation in File input
CVE: CVE-2026-2320
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-10T00:00:00+00:00

Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component
CVE: CVE-2026-2770
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:07.898000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the DOM: Bindings (WebIDL) component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
uacce: fix isolate sysfs check condition
CVE: CVE-2026-23094
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

uacce: fix isolate sysfs check condition

uacce supports the device isolation feature. If the driver
implements the isolate_err_threshold_read and
isolate_err_threshold_write callback functions, uacce will create
sysfs files now. Users can read and configure the isolation policy
through sysfs. Currently, sysfs files are created as long as either
isolate_err_threshold_read or isolate_err_threshold_write callback
functions are present.

However, accessing a non-existent callback function may cause the
system to crash. Therefore, intercept the creation of sysfs if
neither read nor write exists; create sysfs if either is supported,
but intercept unsupported operations at the call site.


Remediation:
CVE: CVE-2026-2635
Component: MLflow Use of Default Password Authentication Bypass Vulnerability
Release date: 2026-02-19T14:15:20.254000+00:00

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incorrect security UI in PictureInPicture
CVE: CVE-2026-3927
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

An incorrect security ui flaw was found in the PictureInPicture component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=474948986

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
SoupServer: Denial of Service via HTTP request smuggling
CVE: CVE-2026-1760
Component: libsoup
CWE: CWE-444
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-02T00:00:00+00:00

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.

Statement: A moderate-impact HTTP request smuggling vulnerability exists in SoupServer due to improper connection handling. When processing requests that use Transfer-Encoding: chunked together with Connection: keep-alive, the server fails to close the connection as required by the HTTP specification. This may allow additional client-supplied data to be interpreted as a new HTTP request, leading to unintended request processing or denial-of-service conditions. SoupServer is primarily intended for lightweight, internal, development, or testing use cases rather than hardened internet-facing deployments, which limits the practical impact of this issue.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GnuPG: Remote code execution and denial of service via crafted CMS EnvelopedData message
CVE: CVE-2026-24881
Component: GnuPG
CWE: CWE-121
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-27T18:36:56.727000+00:00

A flaw was found in GnuPG. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. This message, containing an oversized wrapped session key, can cause a stack-based buffer overflow in the gpg-agent component. Successful exploitation may lead to a denial of service and potentially remote code execution.

Statement: IMPORTANT: A stack-based buffer overflow in the gpg-agent component of GnuPG can be triggered by a remote attacker sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. This vulnerability could lead to a denial of service and potentially remote code execution on affected Red Hat products where gpg-agent processes such messages.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Nebula: Blocklist evasion via ECDSA Signature Malleability
CVE: CVE-2026-25793
Component: nebula
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-06T22:55:36.011000+00:00

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.

Statement: While the flaw is rated as Important, please keep in mind that there are several preconditions that must be true for a customer to be impacted:
1. They must be used CURVE_P256 certificates (which are not the default).
2. They must have one or more entries on their blocklist.
3. The certificates of those blocklisted entries must be signed by a trusted CA and not expired.
4. An attacker must have a copy of the private key and corresponding certificate for one of those blocklist entries.

Remediation:
Axios affected by Denial of Service via __proto__ Key in mergeConfig
CVE: CVE-2026-25639
Component: axios
CWE: CWE-1287
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-09T20:11:22.374000+00:00

A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.


Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
See Kiali 1.73.27 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x
See Kiali 2.11.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat
See Kiali 2.17.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat
See Kiali 2.4.13 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.