huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Keycloak IDOR in realm client creating/deleting
CVE: CVE-2025-14777
Component: keycloak
CWE: CWE-289
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
Release date: 2025-12-16T04:57:00+00:00

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
nbd: restrict sockets to TCP and UDP
CVE: CVE-2025-40080
Component: kernel
CWE: CWE-1287
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nbd: restrict sockets to TCP and UDP

Recently, syzbot started to abuse NBD with all kinds of sockets.

Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.

Explicitely accept TCP and UNIX stream sockets.


Remediation:
Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init
CVE: CVE-2025-38248
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-09T00:00:00+00:00

A flaw was found in the Linux kernel's bridge multicast functionality. A local user could trigger a use-after-free vulnerability, a type of memory corruption, by improperly configuring network bridge router ports. This issue arises because the system fails to correctly remove ports from its internal router port lists, leading to references to freed memory. Exploiting this flaw could result in system instability, denial of service, or potentially allow for privilege escalation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Spoofing issue in the Downloads Panel component
CVE: CVE-2025-14327
Component: firefox
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2025-12-09T13:38:02.260000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
Spoofing issue in the Downloads Panel component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
wifi: mac80211: don't WARN for connections on invalid channels
CVE: CVE-2025-71227
Component: kernel
CWE: CWE-393
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's mac80211 WiFi subsystem. When a regulatory change disables a channel between the time it is scanned and when a connection attempt is made, a kernel warning (WARN) is triggered. This fix replaces the warning with a more informative error message, as the warning was not appropriate for this recoverable condition.

Statement: This is a code quality fix that replaces an inappropriate WARN_ON with an error message. The warning could be triggered by legitimate regulatory domain changes during WiFi operations. No actual crash or security-relevant behavior occurs; the connection simply fails gracefully.

Remediation:
Stored Procedure unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50080
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-15T19:27:41.304000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
OpenCC: Heap-based buffer overflow in MaxMatchSegmentation function allows local attackers to impact system integrity.
CVE: CVE-2025-15536
Component: opencc
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in BYVoid OpenCC. This vulnerability involves a heap-based buffer overflow, a type of memory corruption, within the MaxMatchSegmentation function. A local attacker can exploit this by providing specially crafted input, which may lead to information disclosure, denial of service, or potentially arbitrary code execution. An exploit for this issue is publicly available.

Statement: Exploiting this vulnerability requires that the system allows untrusted input from local users.

Remediation:
A website may be able to access sensor information without user consent
CVE: CVE-2025-43356
Component: webkitgtk
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.

Statement: To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.

Remediation:
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
fbdev: omapfb: Add 'plane' value check
CVE: CVE-2025-37851
Component: kernel
Severity: None
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omapfb: Add 'plane' value check

Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB
of the enum parameter plane.

The value of this parameter is initialized in dss_init_overlays and in the
current state of the code it cannot take this value so it's not a real
problem.

For the purposes of defensive coding it wouldn't be superfluous to check
the parameter value, because some functions down the call stack process
this value correctly and some not.

For example, in dispc_ovl_setup_global_alpha it may lead to buffer
overflow.

Add check for this value.

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.


Remediation:
CVE: CVE-2025-6443
Component: Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability
Release date: 2025-06-25T21:29:14.744000+00:00

Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
CVE: CVE-2025-27152
Component: axios
CWE: CWE-918
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-07T15:13:15.155000+00:00

A flaw was discovered in Axios. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠`baseURL` is set, axios sends the request to the specified absolute URL, which can potentially lead to server-side request forgery (SSRF). This issue impacts both server-side and client-side usage of axios.

Statement: As per further reports credential leakage is not possible in this SSRF, which is why confidentiality has been marked as low and Red Hat has evaluated this vulnerability as moderate severity.

Remediation:
drm/amd/display: Fix out-of-bound accesses
CVE: CVE-2025-21985
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix out-of-bound accesses

[WHAT & HOW]
hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),
but location can have size up to 6. As a result, it is necessary to
check location against MAX_HPO_DP2_ENCODERS.

Similiarly, disp_cfg_stream_location can be used as an array index which
should be 0..5, so the ASSERT's conditions should be less without equal.


Remediation:
Authenticated remote code execution risk in the Moodle LMS Dropbox repository
CVE: CVE-2025-3641
Component: moodle
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-22T12:00:00+00:00

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
PyTorch torch.mkldnn_max_pool2d denial of service
CVE: CVE-2025-2953
Component: torch
CWE: CWE-404
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-30T15:31:04.853000+00:00

A flaw was found in PyTorch. This vulnerability allows denial of service via local exploitation.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Vault LDAP MFA Bypass
CVE: CVE-2025-6013
Component: github.com/hashicorp/vault
CWE: CWE-156
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-08-06T10:06:55.668000+00:00

A flaw was found in github.com/hashicorp/vault. The LDAP authentication method fails to properly enforce multi-factor authentication when `username_as_alias` is enabled and a user possesses multiple Common Names (CNs) containing differing leading or trailing spaces. A remote attacker authenticated as a user meeting these conditions can bypass MFA. This can allow unauthorized access to resources protected by Vault. The underlying issue is an incorrect comparison of Common Names.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-43213
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
CVE: CVE-2025-7252
Component: IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:50:48.630000+00:00

IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26109.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
AIOHTTP HTTP Request/Response Smuggling
CVE: CVE-2025-53643
Component: aiohttp
CWE: CWE-444
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-07-14T20:17:18.247000+00:00

A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protections.


Remediation:
Red Hat Ansible Automation Platform
For details on how to apply this update, refer to Ansible Automation Platform documentation.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
For Red Hat OpenShift AI 2.22.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 2.25.1 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
See Red Hat OpenShift Service Mesh 3.1.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1
See Red Hat OpenShift Service Mesh 3.0.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions
CVE: CVE-2025-11060
Component: SurrealDB
CWE: CWE-863
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-09-11T21:53:23+00:00

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A malicious website may exfiltrate data cross-origin
CVE: CVE-2025-31205
Component: webkitgtk
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-05-15T00:00:00+00:00

A flaw was found in WebKitGTK. A malicious website may steal data cross-origin due to improper security checks within the web browser or rendering engine, leading to unauthorized disclosure of information.

Statement: To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
net/mlx5: Fix double unregister of HCA_PORTS component
CVE: CVE-2025-68790
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A use-after-free vulnerability was found in the Mellanox mlx5 driver in the Linux kernel. The HCA_PORTS devcom component is not cleared from device private data after being unregistered during LAG teardown. When PCI error recovery triggers two passes through mlx5_unload_one(), the second pass attempts to unregister an already-freed component, causing a use-after-free and kernel panic.

Statement: This vulnerability primarily affects s390 systems with Mellanox network adapters where PCI error recovery events trigger multiple unload passes. The issue requires specific error recovery timing conditions to manifest. While the use-after-free causes a kernel panic, the attack surface is limited to systems experiencing PCI-level errors.

Remediation:
ocfs2: validate l_tree_depth to avoid out-of-bounds access
CVE: CVE-2025-22079
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is
limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid
value, which may occur when reading from a corrupted mounted disk [1].


Remediation:
Dire Wolf: Denial of Service due to stack-based buffer overflow in KISS frame processing
CVE: CVE-2025-34457
Component: github.com/wb2osz/direwolf
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-22T21:30:29.670000+00:00

A flaw was found in Dire Wolf. A remote unauthenticated attacker could exploit a stack-based buffer overflow vulnerability in the `kiss_rec_byte()` function when processing specially crafted KISS (KISS is a protocol for transmitting AX.25 frames over a serial link) frames that exceed the maximum allowed length. This leads to an out-of-bounds write and read, causing stack memory corruption or application crashes, ultimately resulting in a Denial of Service (DoS) condition.

Statement: This vulnerability is rated IMPORTANT as Dire Wolf, available in Fedora, is susceptible to a denial-of-service condition. A remote unauthenticated attacker can exploit a stack-based buffer overflow by sending specially crafted KISS frames, leading to application crashes.

Remediation: