huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
macvlan: fix error recovery in macvlan_common_newlink()
CVE: CVE-2026-23209
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

A use-after-free vulnerability was found in the macvlan driver. When creating a macvlan interface in source mode fails after the source MAC has been added to the hash table (e.g., due to an invalid interface name), the hash entry still references the freed net_device structure. Subsequent packets matching that source MAC trigger use-after-free in macvlan_forward_source().

Statement: This vulnerability can be exploited by a local user with CAP_NET_ADMIN to trigger use-after-free by creating a macvlan with an invalid name. The detailed reproducer and analysis were provided by a security researcher. This could potentially be used for privilege escalation via controlled memory corruption.

Remediation:
To mitigate this issue, prevent module macvlan from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
CVE: CVE-2026-21721
Component: grafana/grafana/pkg/services/dashboards
CWE: CWE-639
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-01-27T09:07:55.160000+00:00

An authorization error has been discovered in Grafana dashboards. The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ONNX: Untrusted Model Repository Warnings Suppressed
CVE: CVE-2026-28500
Component: onnx
CWE: CWE-829
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-03-18T01:15:07.644000+00:00

A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. A security control bypass exists in the `onnx.hub.load()` function due to improper logic in its repository trust verification. An attacker can exploit this by providing a malicious model, which, when loaded with the `silent=True` parameter, suppresses all security warnings. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Use-after-free in the JavaScript: GC component
CVE: CVE-2026-2797
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:27.406000+00:00

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
FreeRDP: Denial of Service via crafted RDP Window Icon data
CVE: CVE-2026-26271
Component: freerdp
CWE: CWE-805
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T20:40:19.377000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachable over the network when a client processes icon data from an RDP server (or from a man-in-the-middle). Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Backstage Scaffolder Backend: Information disclosure via malicious template bypassing log redaction
CVE: CVE-2026-29184
Component: @backstage/plugin-scaffolder-backend
CWE: CWE-117
Severity: Low
CVSS v3: 2.4/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-03-07T15:03:18.226000+00:00

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: rsi: Fix memory corruption due to not set vif driver data size
CVE: CVE-2026-23073
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: Fix memory corruption due to not set vif driver data size

The struct ieee80211_vif contains trailing space for vif driver data,
when struct ieee80211_vif is allocated, the total memory size that is
allocated is sizeof(struct ieee80211_vif) + size of vif driver data.
The size of vif driver data is set by each WiFi driver as needed.

The RSI911x driver does not set vif driver data size, no trailing space
for vif driver data is therefore allocated past struct ieee80211_vif .
The RSI911x driver does however use the vif driver data to store its
vif driver data structure "struct vif_priv". An access to vif->drv_priv
leads to access out of struct ieee80211_vif bounds and corruption of
some memory.

In case of the failure observed locally, rsi_mac80211_add_interface()
would write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv;
vif_info->vap_id = vap_idx. This write corrupts struct fq_tin member
struct list_head new_flows . The flow = list_first_entry(head, struct
fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus
address, which when accessed causes a crash.

The trigger is very simple, boot the machine with init=/bin/sh , mount
devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1",
"ip link set wlan0 down" and the crash occurs.

Fix this by setting the correct size of vif driver data, which is the
size of "struct vif_priv", so that memory is allocated and the driver
can store its driver data in it, instead of corrupting memory around
it.


Remediation:
Object lifecycle issue in DevTools
CVE: CVE-2026-3539
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Inappropriate implementation in Background Fetch API
CVE: CVE-2026-1504
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-01-27T00:00:00+00:00

Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state
CVE: CVE-2026-23136
Component: kernel
CWE: CWE-440
Severity: Moderate
CVSS v3: 7.5/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's libceph OSD client. When a connection fault occurs during a sparse read, the sparse-read state is not properly reset. This allows a misbehaving or compromised Ceph OSD server, or a network adversary, to disrupt traffic. As a result, the client can misinterpret new data as a continuation of previous data, leading to a persistent failure mode, repeated errors, and continuous retry loops, effectively causing a Denial of Service (DoS) for Ceph clients performing sparse reads.

Statement: A reliability and availability issue exists in the libceph OSD client sparse read handling. The client tracks progress of a sparse read reply using a separate state machine. When a connection fault happens mid payload or when the sparse read state machine returns an error, the connection is abandoned and later reestablished and pending operations are retried. However 
the sparse read state was not reset on the fault path. As a result the client can misinterpret the beginning of a new reply as a continuation of the previous reply. This can drive the sparse read machinery into a persistent failure mode that may never recover, producing repeated error messages and repeated socket read failures, effectively preventing successful reads and causing continuous retry loops. From a threat perspective the trigger can be a misbehaving or compromised Ceph OSD server, or a network adversary able to disrupt or truncate traffic, causing fault and retry sequences. The primary impact is denial of service for Ceph clients performing sparse reads.

Remediation:
file-type: Denial of Service due to infinite loop in ASF file parsing
CVE: CVE-2026-31808
Component: file-type
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-10T21:01:55.466000+00:00

No description is available for this CVE.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
CVE: CVE-2026-2778
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:13.564000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
cert-manager: Denial of Service via crafted DNS entry
CVE: CVE-2026-25518
Component: github.com/cert-manager/cert-manager
CWE: CWE-1285
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T21:18:06.681000+00:00

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in denial‑of‑service (DoS) of the cert-manager controller. The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor. This issue has been patched in versions 1.18.5 and 1.19.3.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-1292
Component: Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.
Release date: 2026-02-19T23:09:55.630000+00:00

Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
CVE: CVE-2026-26158
Component: busybox
CWE: CWE-73
Severity: Important
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-11T00:00:00+00:00

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.


Remediation:
As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation.
Linux kernel (idpf): Memory leak leading to denial of service via improper cleanup during module removal
CVE: CVE-2026-23024
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A flaw was found in the Linux kernel's `idpf` module. This vulnerability allows a local user to cause a memory leak by removing the module while active flow steering list entries are present. The flaw occurs because the list is not properly cleaned up during module removal. Over time, this memory leak can lead to a denial of service (DoS) on the system.


Remediation:
@angular/compiler: Angular has XSS in i18n attribute bindings
CVE: CVE-2026-32635
Component: @angular/core
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-03-13T20:58:12.554000+00:00

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP: Denial of Service via heap use-after-free in clipboard handling
CVE: CVE-2026-25959
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-25T20:36:09.791000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls `xf_cliprdr_clear_cached_data` → `HashTable_Clear` which frees the same data via `xf_cached_data_free`, triggering a heap use after free. Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2026-20608
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Wasmtime: Denial of Service via excessive HTTP header fields
CVE: CVE-2026-27572
Component: wasmtime
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2026-02-24T21:31:50.186000+00:00

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Heap use-after-free vulnerability allows denial of service via crafted MSL file
CVE: CVE-2026-28687
Component: ImageMagick
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-09T21:37:24.006000+00:00

A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. A heap use-after-free vulnerability in ImageMagick's MSL (Magick Scripting Language) decoder allows an attacker to trigger access to freed memory by crafting a malicious MSL file. This can lead to a denial of service.

Statement: MODERATE: This flaw in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by processing a specially crafted MSL file. This could lead to application crashes or potentially arbitrary code execution. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected by this vulnerability.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted or suspicious MSL files with ImageMagick. Implement strict input validation and ensure that ImageMagick only processes files from trusted sources. If ImageMagick is deployed in a server environment, consider isolating the application within a sandboxed environment to limit potential impact.
ImageMagick: Denial of Service due to improper pointer initialization
CVE: CVE-2026-22770
Component: ImageMagick
CWE: CWE-763
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-01-20T00:48:19.241000+00:00

A flaw was found in ImageMagick. The BilateralBlurImage method improperly initializes a memory buffer. This can lead to the release of an invalid pointer if memory allocation fails. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) by providing a specially crafted image, leading to application instability or crashes.

Statement: This vulnerability is rated Moderate for Red Hat products as it affects ImageMagick, a widely used image processing library. A flaw in the `BilateralBlurImage` method can lead to a release of an invalid pointer when memory allocation fails, potentially resulting in a denial of service. This issue impacts Red Hat Enterprise Linux 6 ELS, 7 ELS, and Community Projects like EPEL and Fedora.

Remediation:
To mitigate this issue, avoid processing untrusted image files with ImageMagick. If ImageMagick is used in an automated or server-side context, consider implementing sandboxing mechanisms to limit the impact of potential exploitation. Restricting the sources of images processed by ImageMagick to trusted origins can also reduce exposure.
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
CVE: CVE-2026-27122
Component: svelte
CWE: CWE-1286
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-20T22:28:37.824000+00:00

svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mm/shmem, swap: fix race of truncate and swap entry split
CVE: CVE-2026-23161
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A race condition was found in the Linux kernel's shmem/swap handling during truncate operations. The swap entry order is retrieved without proper lock protection, allowing it to become stale before the subsequent xa_cmpxchg_irq operation. This can cause truncation to erase data beyond the intended end border or lead to swapoff hangs and kernel panics.

Statement: This race condition requires specific timing between truncate operations and swap entry splits under ZSWAP stress. While it can cause kernel panics, it's difficult to trigger reliably and primarily affects systems using ZSWAP with shmem/tmpfs under heavy memory pressure. No data confidentiality or integrity impact beyond the crash.

Remediation: