huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Keycloak: Unauthorized organization registration via improper invitation token validation
CVE: CVE-2026-1529
Component: org.keycloak.services.resources.organizations
CWE: CWE-347
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-09T18:21:00+00:00

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Statement: This IMPORTANT flaw in Keycloak allows an attacker to register into an unauthorized organization. The vulnerability arises from improper cryptographic signature verification of organization invitation tokens, enabling modification of the organization ID and target email within the JWT payload.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Quill: Denial of Service via unbounded HTTP response body read
CVE: CVE-2026-31960
Component: github.com/anchore/quill
CVSS v3: 5.2/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-11T19:31:34.867000+00:00

A flaw was found in Quill. An attacker with the ability to intercept and modify network traffic, such as through a TLS-intercepting proxy or a compromised certificate authority, could send an arbitrarily large HTTP response body during the Apple notarization process. This unbounded read of the response body into memory would cause the Quill client to run out of memory and crash, leading to a Denial of Service (DoS) for the application.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
janet-lang: Denial of service via out-of-bounds read in janetc_pop_funcdef
CVE: CVE-2026-2240
Component: janet-lang
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T15:32:10.307000+00:00

A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such manipulation leads to out-of-bounds read. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5. A patch should be applied to remediate this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0787
Component: ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:55:07.406000+00:00

ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SAC module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28296.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Caddy: Remote Code Execution via FastCGI path confusion
CVE: CVE-2026-27590
Component: github.com/caddyserver/caddy/v2/modules/caddyhttp
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-24T16:33:41.353000+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FreeRDP: Use-after-free vulnerability leading to denial of service
CVE: CVE-2026-25954
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-25T20:30:32.755000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
cgroup/dmem: fix NULL pointer dereference when setting max
CVE: CVE-2026-23183
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cgroup/dmem: fix NULL pointer dereference when setting max

An issue was triggered:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0000 [#1] SMP NOPTI
 CPU: 15 UID: 0 PID: 658 Comm: bash Tainted: 6.19.0-rc6-next-2026012
 Tainted: [O]=OOT_MODULE
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
 RIP: 0010:strcmp+0x10/0x30
 RSP: 0018:ffffc900017f7dc0 EFLAGS: 00000246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888107cd4358
 RDX: 0000000019f73907 RSI: ffffffff82cc381a RDI: 0000000000000000
 RBP: ffff8881016bef0d R08: 000000006c0e7145 R09: 0000000056c0e714
 R10: 0000000000000001 R11: ffff888107cd4358 R12: 0007ffffffffffff
 R13: ffff888101399200 R14: ffff888100fcb360 R15: 0007ffffffffffff
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 0000000105c79000 CR4: 00000000000006f0
 Call Trace:
  <TASK>
  dmemcg_limit_write.constprop.0+0x16d/0x390
  ? __pfx_set_resource_max+0x10/0x10
  kernfs_fop_write_iter+0x14e/0x200
  vfs_write+0x367/0x510
  ksys_write+0x66/0xe0
  do_syscall_64+0x6b/0x390
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x7f42697e1887

It was trriggered setting max without limitation, the command is like:
"echo test/region0 > dmem.max". To fix this issue, add check whether
options is valid after parsing the region_name.


Remediation:
SVGO: Denial of Service via XML entity expansion
CVE: CVE-2026-29074
Component: svgo
CWE: CWE-776
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-06T07:23:05.716000+00:00

A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libtpms: Remote data confidentiality compromise via incorrect Initialization Vector (IV) handling
CVE: CVE-2026-21444
Component: limtpms
CWE: CWE-1204
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-01-02T19:05:31.503000+00:00

A flaw was found in libtpms, a library for Trusted Platform Module (TPM) emulation. An attacker with low privileges could exploit this vulnerability when libtpms is integrated with OpenSSL 3.x and certain symmetric ciphers are used. The library incorrectly returns the initial Initialization Vector (IV) instead of the last one, weakening subsequent encryption and decryption operations and potentially compromising data confidentiality.

Statement: This vulnerability is rated Moderate for Red Hat. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected as the libtpms shipped with those products doesn't contain the vulnerable code. The flaw in libtpms, when integrated with OpenSSL 3.x, leads to incorrect Initialization Vector (IV) handling, potentially compromising data confidentiality in affected Fedora releases.

Remediation:
LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()
CVE: CVE-2026-23029
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()

In kvm_ioctl_create_device(), kvm_device has allocated memory,
kvm_device->destroy() seems to be supposed to free its kvm_device
struct, but kvm_eiointc_destroy() is not currently doing this, that
would lead to a memory leak.

So, fix it.


Remediation:
Libsoup: Authentication bypass via digest authentication replay attack
CVE: CVE-2026-3099
Component: libsoup
CWE: CWE-323
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2026-02-24T01:01:00+00:00

A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.

Statement: This issue was rated as having a moderate impact. A flaw exists in Libsoup's server-side digest authentication, which does not properly track nonces or enforce incrementing nonce-counts. This allows an attacker to replay captured authentication headers, bypassing authentication and gaining unauthorized access to protected resources.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/sched: act_gate: snapshot parameters with RCU on replace
CVE: CVE-2026-23245
Component: kernel
Severity: None
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
libssh: Denial of Service via improper configuration file handling
CVE: CVE-2026-0965
Component: libssh
CWE: CWE-73
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-10T18:47:22.524000+00:00

No description is available for this CVE.


Remediation:
Ensure the client and server are using only regular files as configuration.
Moodle: Uncontrolled Resource Consumption in TeX Formula Editor Leading to Denial of Service
CVE: CVE-2026-26047
Component: moodle
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-19T00:00:00+00:00

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade performance or cause service interruption.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
zumba/json-serializer: Remote Code Execution via untrusted JSON deserialization
CVE: CVE-2026-27206
Component: zumba/json-serializer
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-21T07:01:00.843000+00:00

A flaw was found in zumba/json-serializer. A remote attacker can exploit a deserialization vulnerability by providing untrusted JSON input that leverages a special @type field to instantiate arbitrary classes. This can lead to PHP Object Injection, potentially allowing the attacker to achieve Remote Code Execution (RCE), which means running malicious code on the affected system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
flatted: Unbounded recursion DoS in parse() revive phase
CVE: CVE-2026-32141
Component: flatted
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-12T18:08:09.634000+00:00

A denial of service flaw has been discovered in the flatted npm library. flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A remote attacker may be able to cause a denial-of-service
CVE: CVE-2026-20652
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in WebKitGTK. A remote attacker may be able to cause a denial-of-service due to improper memory handling.

Statement: This issue allows a remote attacker to cause a denial-of-service. Due to this reason, this flaw has been rated with an important severity.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Local Privilege Escalation in snapd
CVE: CVE-2026-3888
Component: snapd
CVSS v3: 7.7/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-03-17T14:02:08.475000+00:00

A privilege escalation flaw has been discovered in snapd. This local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in MediaStream
CVE: CVE-2026-3922
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An use after free flaw was found in the MediaStream component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=485397139

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
go-tuf improperly validates the configured threshold for delegations
CVE: CVE-2026-23992
Component: github.com/theupdateframework/go-tuf/v2
CWE: CWE-347
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-01-22T02:20:06.845000+00:00

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Mitigation bypass in the DOM: HTML Parser component
CVE: CVE-2026-2775
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:11.553000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Mitigation bypass in the DOM: HTML Parser component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
intel_th: fix device leak on output open()
CVE: CVE-2026-23091
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

intel_th: fix device leak on output open()

Make sure to drop the reference taken when looking up the th device
during output device open() on errors and on close().

Note that a recent commit fixed the leak in a couple of open() error
paths but not all of them, and the reference is still leaking on
successful open().


Remediation:
ImageMagick: Denial of Service Vulnerability
CVE: CVE-2026-25796
Component: ImageMagick
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T00:57:27.441000+00:00

A flaw was found in ImageMagick, an open-source software for image manipulation. This vulnerability is a memory leak that occurs when processing certain image objects. An attacker can exploit this flaw to repeatedly trigger the memory leak, which can lead to a Denial of Service (DoS) by consuming excessive system memory and making the application unavailable.

Statement: This MODERATE impact vulnerability in ImageMagick involves a memory leak when processing certain image files due to unfreed objects in the `ReadSTEGANOImage()` function. This flaw can lead to a denial of service by exhausting system memory. Red Hat Enterprise Linux and community projects utilizing ImageMagick are affected.

Remediation:
To mitigate this issue, avoid processing untrusted or maliciously crafted image files with ImageMagick. If ImageMagick is used in a server-side application or service that handles external input, consider implementing resource limits for the ImageMagick process to prevent excessive memory consumption, or run the process within a sandboxed environment to contain potential denial of service attacks.
Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions
CVE: CVE-2026-27601
Component: Underscore.js
CWE: CWE-606
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-03T22:38:38.955000+00:00

A flaw was found in Underscore.js, a JavaScript utility library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) attack by providing specially crafted recursive data structures. When these structures are processed by the _.flatten or _.isEqual functions, which lack a depth limit for recursion, a stack overflow occurs. This can make the application unavailable to legitimate users.


Remediation:
To mitigate this issue, applications utilizing Underscore.js should ensure that any processing of untrusted, recursively structured data with `_.flatten` or `_.isEqual` explicitly enforces a finite depth limit. Review application code to identify and modify calls to these functions, adding appropriate depth parameters to prevent stack overflow conditions. Additionally, input validation should be implemented to sanitize untrusted data before it is processed by Underscore.js functions.
bonding: annotate data-races around slave->last_rx
CVE: CVE-2026-23212
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bonding: annotate data-races around slave->last_rx

slave->last_rx and slave->target_last_arp_rx[...] can be read and written
locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.

syzbot reported:

BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:
  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335
  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533
  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039
  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]
  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265
  netif_receive_skb_internal net/core/dev.c:6351 [inline]
  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
...

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:
  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335
  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533
  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039
  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]
  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265
  netif_receive_skb_internal net/core/dev.c:6351 [inline]
  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
  br_netif_receive_skb net/bridge/br_input.c:30 [inline]
  NF_HOOK include/linux/netfilter.h:318 [inline]
...

value changed: 0x0000000100005365 -> 0x0000000100005366


Remediation: