huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
QGIS GitHub Actions workflow: Remote Code Execution and repository compromise via insecure `pull_request_target` configuration
CVE: CVE-2026-24480
Component: QGIS
CVSS v3: 9.6/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-01-27T00:32:04.725000+00:00

A flaw was found in the QGIS GitHub Actions workflow. This vulnerability allowed a remote attacker to achieve remote code execution and compromise the repository. The flaw occurred because the workflow used the `pull_request_target` trigger, which runs with the base repository's credentials, and then executed untrusted code from external pull requests in a privileged context. This could enable an attacker to execute arbitrary commands with elevated privileges within the QGIS project's continuous integration/continuous delivery (CI/CD) environment.

Statement: In the Red Hat context, the impact of this vulnerability is limited as it affects the GitHub Actions workflow of the QGIS project, not the QGIS application distributed in Red Hat products. The flaw allowed remote code execution and repository compromise within the QGIS project's CI/CD environment. Red Hat products that consume QGIS packages are not directly exposed to this vulnerability.

Remediation:
wsgiref.headers.Headers allows header newline injection in Python
CVE: CVE-2026-0865
Component: cpython
CWE: CWE-74
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Release date: 2026-01-20T21:26:15.274000+00:00

Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers.


Remediation:
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
vLLM: Arbitrary code execution via untrusted model loading
CVE: CVE-2026-22807
Component: vLLM
CWE: CWE-94
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-21T21:13:11.894000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows a remote attacker to achieve arbitrary code execution on the vLLM host during model loading. This occurs because vLLM loads Hugging Face `auto_map` dynamic modules without properly validating the `trust_remote_code` setting. By influencing the model repository or path, an attacker can execute malicious Python code at server startup, even before any API requests are handled.

Statement: This vulnerability is rated Important for Red Hat as vLLM, an inference and serving engine for large language models, is vulnerable to arbitrary code execution. An attacker influencing the model repository or path can execute malicious Python code during server startup, affecting vLLM versions 0.10.1 through 0.13.x.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.4.0-ea.1 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
To mitigate this issue, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modification or introduction of malicious code. Implement strict access controls and integrity checks for all model sources.
ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
CVE: CVE-2026-23200
Component: kernel
CWE: CWE-617
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A kernel BUG (assertion failure) was found in the IPv6 routing code. When a static route is added with the same nexthop as an existing RA-learned route that has a gateway, the RTF_ADDRCONF flag is cleared, making the route ECMP-eligible without being in the fib6_siblings list. This causes a sibling count mismatch that triggers BUG_ON() when adding subsequent ECMP routes.

Statement: This crash can be triggered by adding IPv6 routes in specific sequences involving both router-advertisement-learned routes and static routes. A local user with routing configuration privileges (CAP_NET_ADMIN) can trigger the kernel BUG. The impact is denial of service.

Remediation:
fou: Don't allow 0 for FOU_ATTR_IPPROTO
CVE: CVE-2026-23083
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fou: Don't allow 0 for FOU_ATTR_IPPROTO.

fou_udp_recv() has the same problem mentioned in the previous
patch.

If FOU_ATTR_IPPROTO is set to 0, skb is not freed by
fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().

Let's forbid 0 for FOU_ATTR_IPPROTO.


Remediation:
OliveTin: Arbitrary file write via directory traversal in log file naming
CVE: CVE-2026-31817
Component: olivetin
CVSS v3: 8.2/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Release date: 2026-03-10T21:08:53.873000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in DPLL framework due to duplicate pin registrations
CVE: CVE-2026-23129
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Digital Phase-Locked Loop (DPLL) framework. A local user can exploit this by repeatedly registering the same DPLL pin or object. This can lead to an inconsistent state within the subsystem when unregistering, causing kernel log warnings and potentially device malfunction. This vulnerability can result in a local Denial of Service (DoS).

Statement: A logic flaw in the Linux DPLL framework allows duplicate registrations of the same pin or DPLL object for the same device when the registration parameters match ops priv and cookie. Previously the core treated a duplicate as a success and simply incremented an internal refcount while keeping only one allocated registration object. If a caller then performs a matching number of unregistrations the first unregistration frees the underlying registration structure and subsequent unregistrations trigger WARNs and can leave the subsystem in an inconsistent state. While this is primarily a robustness issue it can be relevant for security because it can be used to induce warnings kernel log noise and potentially device or subsystem malfunction which can amount to a local denial of service.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
thunderbird: Use-after-free in the JavaScript: WebAssembly component
CVE: CVE-2026-2767
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:05.551000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the JavaScript: WebAssembly component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
H3: Password deduction via Timing Side-Channel vulnerability in basic authentication
CVE: CVE-2026-33129
Component: h3
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-20T09:41:21.933000+00:00

A flaw was found in H3, a minimal HTTP framework. A remote attacker can exploit a Timing Side-Channel vulnerability in the `requireBasicAuth` function. This vulnerability arises from the use of an unsafe string comparison, allowing the attacker to deduce valid passwords character-by-character by measuring the server's response time. This effectively bypasses password complexity protections, leading to unauthorized access.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Unsafe navigation in Navigation
CVE: CVE-2026-3930
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

An unsafe navigation flaw was found in the Navigation component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=476898368

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
GIMP: Memory corruption due to integer overflow in ICO file handling
CVE: CVE-2026-2272
Component: gimp
CWE: CWE-190
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-10T09:09:00+00:00

No description is available for this CVE.

Statement: This MODERATE impact flaw in GIMP allows a remote attacker to cause an application denial of service. The vulnerability occurs due to an integer overflow when processing specially crafted ICO image files, leading to memory corruption. User interaction is required for exploitation, as a malicious ICO file must be opened by the GIMP application.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Parser unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21952
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component
CVE: CVE-2026-2788
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:20.287000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the Audio/Video: GMP component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
CVE: CVE-2026-1761
Component: libsoup
CWE: CWE-121
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Release date: 2026-02-02T00:00:00+00:00

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.

Statement: This IMPORTANT flaw in libsoup involves a stack-based buffer overflow during the parsing of multipart HTTP responses. A remote attacker can exploit this vulnerability by sending a specially crafted response, leading to memory corruption and potentially arbitrary code execution or application crashes in Red Hat products that utilize libsoup to process untrusted server responses. This issue does not require authentication or user interaction.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
To mitigate this issue, applications utilizing libsoup that process HTTP responses should be configured to only communicate with trusted endpoints. Implement network egress filtering to restrict vulnerable applications from connecting to untrusted external services, thereby reducing the exposure to specially crafted multipart HTTP responses.
ImageMagick: Denial of Service due to memory leak in image processing
CVE: CVE-2026-25638
Component: ImageMagick
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T00:49:57.947000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted image file. This flaw occurs because the `WriteMSLImage` function in `coders/msl.c` returns early without releasing allocated resources, leading to a memory leak. This can result in a Denial of Service (DoS) condition, making the system or application unavailable.

Statement: A MODERATE impact memory leak exists in ImageMagick's MSL encoder, where unreleased resources can lead to denial of service due to resource exhaustion. This affects Red Hat Enterprise Linux 6 ELS and 7 ELS, where ImageMagick is used for image processing.

Remediation:
To mitigate this issue, avoid processing untrusted MSL (Magick Scripting Language) files with ImageMagick. If ImageMagick is deployed in a server environment, consider implementing resource limits for processes handling image conversions to prevent complete resource exhaustion.
scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
CVE: CVE-2026-23216
Component: kernel
CWE: CWE-413
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's iSCSI target subsystem. In the iscsit_dec_conn_usage_count() function, complete() is called while still holding the conn->conn_usage_lock spinlock. The waiting thread (such as iscsit_close_connection()) may wake up immediately and free the iscsit_conn structure before the current thread executes spin_unlock_bh(), resulting in a use-after-free when attempting to release the lock on already-freed memory.

Statement: This vulnerability requires the iSCSI target subsystem to be configured and in use, which limits the attack surface to systems actively serving as iSCSI targets. The race condition is timing-dependent and requires specific connection teardown sequences to trigger. Successful exploitation could lead to kernel crash or potentially memory corruption.

Remediation:
To mitigate this issue, prevent the iscsi_target_mod module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.
Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key
CVE: CVE-2026-26014
Component: github.com/pion/dtls
CWE: CWE-323
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-11T21:07:50.187000+00:00

A vulnerability has been identified in the Pion DTLS implementation where the use of random nonce generation with AES-GCM ciphers does not adhere to recommended cryptographic practices. Under certain conditions, this may allow remote attackers to more easily derive or reuse encryption authentication keys, potentially leading to spoofed or compromised DTLS sessions during communication.

Statement: Red Hat Product Security classified this issue as Moderate severity, because an unauthenticated remote attacker could, in theory, take advantage of the improper nonce generation in Pion DTLS to more easily obtain the authentication key for AES-GCM ciphers and spoof or manipulate DTLS traffic. However, exploitation requires specific conditions and a detailed understanding of the protocol, contributing to a higher attack complexity. Additionally, there is no direct effect on data integrity or availability solely from this issue, and successful exploitation typically requires carefully crafted, protocol-level interactions. These factors limit the practical risk in most real-world deployments.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
libarchive: Denial of Service via malformed ISO file processing
CVE: CVE-2026-4426
Component: libarchive
CWE: CWE-1335
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-19T00:00:00+00:00

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

Statement: This MODERATE impact vulnerability in `libarchive`'s zisofs decompression logic can lead to a denial of service. The flaw is triggered when processing a specially crafted ISO9660 image containing an invalid shift exponent. Red Hat products that process untrusted ISO files using `libarchive` are susceptible to crashes.

Remediation:
To mitigate this issue, avoid processing untrusted ISO9660 images with `libarchive`. Restricting the sources of ISO files and ensuring they originate from trusted entities can prevent exploitation.
Use after free in Ozone
CVE: CVE-2026-2321
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-10T00:00:00+00:00

Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Undefined behavior in the DOM: Core & HTML component
CVE: CVE-2026-2771
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:08.538000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Undefined behavior in the DOM: Core & HTML component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
gue: Fix skb memleak with inner IP protocol 0
CVE: CVE-2026-23095
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gue: Fix skb memleak with inner IP protocol 0.

syzbot reported skb memleak below. [0]

The repro generated a GUE packet with its inner protocol 0.

gue_udp_recv() returns -guehdr->proto_ctype for "resubmit"
in ip_protocol_deliver_rcu(), but this only works with
non-zero protocol number.

Let's drop such packets.

Note that 0 is a valid number (IPv6 Hop-by-Hop Option).

I think it is not practical to encap HOPOPT in GUE, so once
someone starts to complain, we could pass down a resubmit
flag pointer to distinguish two zeros from the upper layer:

  * no error
  * resubmit HOPOPT

[0]
BUG: memory leak
unreferenced object 0xffff888109695a00 (size 240):
  comm "syz.0.17", pid 6088, jiffies 4294943096
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............
  backtrace (crc a84b336f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270
    __build_skb+0x23/0x60 net/core/skbuff.c:474
    build_skb+0x20/0x190 net/core/skbuff.c:490
    __tun_build_skb drivers/net/tun.c:1541 [inline]
    tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636
    tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770
    tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999
    new_sync_write fs/read_write.c:593 [inline]
    vfs_write+0x45d/0x710 fs/read_write.c:686
    ksys_write+0xa7/0x170 fs/read_write.c:738
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


Remediation:
fast-xml-parser: Denial of Service via unlimited XML entity expansion
CVE: CVE-2026-26278
Component: fast-xml-parser
CWE: CWE-776
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-19T19:40:55.842000+00:00

A denial of service flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted, small XML input. This input can force the XML parser to perform an unlimited amount of entity expansion, consuming excessive resources. This can lead to the application freezing for an extended period, resulting in a Denial of Service (DoS).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Out of bounds read in V8
CVE: CVE-2026-3926
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

An out of bounds read flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=478659010

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
QuestDB UI: Cross-site Scripting vulnerability via Web Console manipulation
CVE: CVE-2026-0824
Component: questdb
CWE: CWE-79
Severity: Moderate
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-01-10T14:32:08.724000+00:00

A flaw was found in QuestDB UI. A remote attacker could exploit a cross-site scripting (XSS) vulnerability by manipulating the Web Console component. This could allow the attacker to inject malicious scripts into web pages, potentially leading to information disclosure or arbitrary code execution in the user's browser context.


Remediation: