huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
PJSIP: Denial of Service via heap use-after-free in event subscription
CVE: CVE-2026-28799
Component: PJSIP
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-06T06:36:55.109000+00:00

A flaw was found in PJSIP. A remote attacker can exploit a heap use-after-free vulnerability within the event subscription framework by sending a specially crafted message during presence unsubscription. This can lead to a denial of service, making the affected system unavailable.

Statement: IMPORTANT: A heap use-after-free vulnerability in PJSIP's event subscription framework allows a remote attacker to cause a denial of service. This flaw is triggered by sending a specially crafted message during presence unsubscription, leading to system unavailability. Red Hat products utilizing PJSIP for presence functionality may be affected.

Remediation:
Use after free in WebMIDI
CVE: CVE-2026-3923
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An use after free flaw was found in the WebMIDI component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=485935314

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Integer overflow in the Audio/Video component
CVE: CVE-2026-2774
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:10.821000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Integer overflow in the Audio/Video component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
slimbus: core: fix device reference leak on report present
CVE: CVE-2026-23090
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

slimbus: core: fix device reference leak on report present

Slimbus devices can be allocated dynamically upon reception of
report-present messages.

Make sure to drop the reference taken when looking up already registered
devices.

Note that this requires taking an extra reference in case the device has
not yet been registered and has to be allocated.


Remediation:
Improper sanitation of paths received from SCP servers
CVE: CVE-2026-0964
Component: libssh
CWE: CWE-22
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-02-10T18:44:42.346000+00:00

No description is available for this CVE.


Remediation:
Do not use SCP! SCP is deprecated for several years and will
be removed in future releases!

If you have to, the application MUST validate the path returned
from `ssh_scp_request_get_filename()` is the path the application
requested. The libssh does not do any writing in this case.
nvme: fix memory allocation in nvme_pr_read_keys()
CVE: CVE-2026-23244
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Moodle: Improper Input Sanitization in TeX Filter Administration Setting
CVE: CVE-2026-26046
Component: moodle
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-19T00:00:00+00:00

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API
CVE: CVE-2026-26103
Component: udisks
CWE: CWE-862
Severity: Important
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-02-25T06:00:00+00:00

A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.

Statement: The Red Hat Product Security team has rated this vulnerability as Moderate. Exploitation requires local system access but no authentication or user interaction. A successful attack allows an unprivileged user to cause the udisks daemon to overwrite LUKS encryption headers, resulting in loss of data integrity and availability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability.
quickjs-ng: Heap-based buffer overflow in js_typed_array_constructor function
CVE: CVE-2026-0821
Component: quickjs-ng
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-01-10T13:02:07.698000+00:00

A flaw was found in quickjs-ng. A remote attacker can exploit a heap-based buffer overflow vulnerability in the `js_typed_array_constructor` function of the `quickjs.c` file by executing a specially crafted manipulation. This vulnerability may lead to information disclosure, denial of service, or potentially arbitrary code execution.

Statement: This vulnerability is rated Important for Red Hat. A heap-based buffer overflow in the `js_typed_array_constructor` function of quickjs-ng can be exploited by a remote attacker through specially crafted manipulation. This flaw may lead to information disclosure, denial of service, or arbitrary code execution. This affects components such as `radare2` in Community Projects (EPEL 8, 9, 10 and Fedora 42, 43).

Remediation:
FreeRDP: Denial of Service via use-after-free in xf_AppUpdateWindowFromSurface
CVE: CVE-2026-25955
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T20:32:42.458000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This use-after-free vulnerability occurs because the `xf_AppUpdateWindowFromSurface` function reuses a cached image whose data pointer references a freed RDPGFX surface buffer. A remote attacker could exploit this flaw, potentially leading to a denial of service (DoS) condition.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
spi: tegra: Fix a memory leak in tegra_slink_probe()
CVE: CVE-2026-23182
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spi: tegra: Fix a memory leak in tegra_slink_probe()

In tegra_slink_probe(), when platform_get_irq() fails, it directly
returns from the function with an error code, which causes a memory leak.

Replace it with a goto label to ensure proper cleanup.


Remediation:
LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
CVE: CVE-2026-23028
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()

In kvm_ioctl_create_device(), kvm_device has allocated memory,
kvm_device->destroy() seems to be supposed to free its kvm_device
struct, but kvm_ipi_destroy() is not currently doing this, that
would lead to a memory leak.

So, fix it.


Remediation:
ImageMagick: Denial of Service via overflow in SFW decoder when processing large images on 32-bit systems
CVE: CVE-2026-31853
Component: imagemagick
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-11T17:09:46.196000+00:00

A flaw was found in ImageMagick. An overflow on 32-bit systems in the SFW decoder can lead to a crash when processing extremely large images. This vulnerability could allow an attacker to cause a Denial of Service (DoS) by providing a specially crafted large image.

Statement: This MODERATE impact flaw in ImageMagick affects 32-bit systems. An attacker could trigger a denial of service by providing a specially crafted, extremely large image for processing by the SFW decoder. This vulnerability is applicable to Red Hat Enterprise Linux 6 ELS and 7 ELS when running on 32-bit architectures.

```

It is important to note that ImageMagick has been removed from Red Hat Enterprise Linux 8 and later releases. Therefore, current supported RHEL 8 and newer systems are not affected by this issue unless ImageMagick is installed from third-party or custom repositories.

For additional information, refer to https://access.redhat.com/solutions/4437561.

```

Remediation:
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.

To reduce the risk of denial of service, avoid processing untrusted or excessively large SFW (Structured Fax File) images with ImageMagick on 32-bit systems.
Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check
CVE: CVE-2026-20736
Component: gitea
CWE: CWE-284
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-01-22T22:01:49.678000+00:00

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.


Remediation:
CVE: CVE-2026-0769
Component: Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:37:55.261000+00:00

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
systeminformation: Arbitrary code execution via unsanitized `locate` output
CVE: CVE-2026-26318
Component: systeminformation
CWE: CWE-78
Severity: Important
CVSS v3: 8.5/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-19T19:48:55.816000+00:00

systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
undici: Denial of Service via crafted WebSocket frame with large length
CVE: CVE-2026-1528
Component: undici
CWE: CWE-248
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-12T20:21:57.775000+00:00

A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici's ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libvips: Memory corruption via local manipulation
CVE: CVE-2026-3145
Component: libvips
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-25T02:02:10.604000+00:00

A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. This patch is called d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. A patch should be applied to remediate this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Quill: Denial of Service via unbounded memory allocation
CVE: CVE-2026-31961
Component: github.com/anchore/quill
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-11T19:32:28.920000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
janet-lang: Denial of Service due to out-of-bounds read
CVE: CVE-2026-2241
Component: janet-lang
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T16:02:08.720000+00:00

A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is named 0f285855f0e34f9183956be5f16e045f54626bff. To fix this issue, it is recommended to deploy a patch.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0786
Component: ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:55:00.212000+00:00

ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the SCI module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28295.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vips: libvips: Information disclosure due to out-of-bounds read
CVE: CVE-2026-3283
Component: libvips
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-27T02:32:12.328000+00:00

A flaw was found in libvips. A local attacker can exploit this vulnerability by manipulating the extract_band argument when calling the vips_extract_band_build function. This can lead to an out-of-bounds read, potentially disclosing sensitive information.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
TensorFlow: Local privilege escalation via uncontrolled search path for plugins
CVE: CVE-2026-2492
Component: tensorflow
CWE: CWE-427
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-20T22:22:54.392000+00:00

A flaw was found in TensorFlow. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code. The flaw exists within the HDF5 library's handling of plugins, which are loaded from an unsecured location. An attacker with low-privileged code execution can exploit this uncontrolled search path to achieve privilege escalation.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5
CVE: CVE-2026-28490
Component: authlib
CWE: CWE-325
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-16T17:37:57.425000+00:00

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. This cryptographic padding oracle vulnerability, affecting the JSON Web Encryption (JWE) RSA1_5 key management algorithm, could allow a remote attacker to decrypt sensitive information. The vulnerability arises because Authlib registers RSA1_5 without requiring explicit opt-in and bypasses constant-time Bleichenbacher mitigations in the underlying cryptography library.

Statement: This MODERATE vulnerability in Authlib exposes a Bleichenbacher padding oracle in the JWE RSA1_5 implementation. Authlib enables RSA1_5 by default and breaks constant-time protections from the cryptography library. Remote attackers can exploit timing side-channels to decrypt encrypted tokens. Exploitation requires high complexity but no authentication. Impact is high confidentiality loss. Affects versions prior to 1.6.9.

Remediation:
pypdf Infinite Loop when processing outlines/bookmarks
CVE: CVE-2026-24688
Component: pypdf
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-27T19:44:06.173000+00:00

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Inappropriate implementation in WebAssembly
CVE: CVE-2026-3542
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
pypdf: Denial of Service via crafted PDF with RunLengthDecode filter
CVE: CVE-2026-28351
Component: pypdf
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2026-02-27T20:59:16.839000+00:00

A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can exploit this vulnerability by crafting a malicious PDF file that, when parsed, leads to excessive memory consumption. This occurs specifically when processing the content stream using the RunLengthDecode filter. Successful exploitation can result in a Denial of Service (DoS) condition due to large memory usage.


Remediation:
InnoDB unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21936
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
NFA regex engine NULL pointer dereference
CVE: CVE-2026-32249
Component: vim
CWE: CWE-476
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-12T19:17:23.954000+00:00

A flaw was found in Vim. A NULL pointer dereference can occur when the NFA regex compiler processes a specific character collection, more specifically one that contains a combining character acting as the endpoint of a character range (e.g., [0-0\u05bb]). A process or user that can supply a regex pattern can cause an application crash, resulting in a denial of service.

Statement: To exploit this issue, an attacker needs to be able to supply a malicious regex pattern to be processed by the NFA regex compiler, including via plugins or command line arguments. Also, this flaw can cause an application crash, resulting only in a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with low severity.

Remediation:
To mitigate this vulnerability, disable the NFA (Non-deterministic Finite Automaton) regex engine and enable the traditional backtracking engine by adding the following option to the Vim configuration file:

~~~
set regexpengine=1
~~~