huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
drm/vmwgfx: Fix KMS with 3D on HW version 10
CVE: CVE-2026-23008
Component: kernel
CWE: CWE-824
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's VMware graphics (vmwgfx) driver. On VMware hardware version 10, which lacks GB Surfaces support, attempting to use 3D acceleration with KMS (Kernel Mode Setting) causes the driver to dereference a NULL backing buffer pointer for surface-backed framebuffers. This results in a kernel crash and black screen.

Statement: This vulnerability specifically affects VMware virtual machines running hardware version 10 with 3D acceleration enabled. The crash occurs when the DRM subsystem attempts to access framebuffer surfaces that don't have backing storage on this hardware version. Newer VMware hardware versions are not affected as they support GB Surfaces.

Remediation:
To mitigate this issue, disable 3D acceleration in VMware virtual machine settings when using hardware version 10, or upgrade to a newer VMware hardware version that supports GB Surfaces.
YosysHQ yosys: Denial of Service via heap-based buffer overflow in BLIF File Parser
CVE: CVE-2026-3407
Component: yosys
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-02T03:02:09.924000+00:00

A flaw was found in YosysHQ yosys, specifically within the BLIF File Parser component. A local user can exploit a heap-based buffer overflow vulnerability by manipulating the Yosys::RTLIL::Const::set function. This manipulation can lead to a denial of service, making the affected system unavailable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
CVE: CVE-2026-23264
Component: kernel
Severity: None
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
ImageMagick: Denial of Service via crafted IPTC data
CVE: CVE-2026-26066
Component: ImageMagick
CWE: CWE-835
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T01:52:30.870000+00:00

A flaw was found in ImageMagick. A local attacker could provide a crafted image profile containing invalid IPTC (International Press Telecommunications Council) data. When ImageMagick attempts to write this data using the `IPTCTEXT` function, it may lead to an infinite loop, resulting in a Denial of Service (DoS) for the application.

Statement: This MODERATE impact flaw in ImageMagick can lead to a denial of service. A crafted profile containing invalid IPTC data may cause an infinite loop when ImageMagick attempts to write it with IPTCTEXT. Red Hat Enterprise Linux systems utilizing ImageMagick to process untrusted image files are affected.

Remediation:
To mitigate this issue, restrict ImageMagick's processing of untrusted image files. If ImageMagick is used in an automated or server-side context, consider implementing sandboxing mechanisms to limit the resources available to the ImageMagick process when handling external input. This can help contain the impact of a denial of service.
Use after free in Network
CVE: CVE-2026-4454
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An use after free flaw was found in the Network component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=488585488

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path
CVE: CVE-2026-26965
Component: freerdp
CWE: CWE-787
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-25T20:59:17.828000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit a heap out-of-bounds write vulnerability in the `planar_decompress_plane_rle()` function. This vulnerability allows the server to write past the end of a temporary buffer, potentially overwriting critical data such as function pointers. This can lead to arbitrary code execution on the connecting FreeRDP client.


Remediation:
Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation
CVE: CVE-2026-24734
Component: tomcat
CWE: CWE-295
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-17T18:53:12.228000+00:00

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol (OCSP) responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability could allow an attacker to bypass certificate revocation checks, potentially leading to the acceptance of revoked certificates.


Remediation:
Heap buffer overflow in Media
CVE: CVE-2026-2650
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-18T00:00:00+00:00

Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Incorrect security UI in PictureInPicture
CVE: CVE-2026-3942
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-10T00:00:00+00:00

An incorrect security ui flaw was found in the PictureInPicture component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=475238879

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
UltraJSON: Denial of Service via large indent parameter in JSON serialization
CVE: CVE-2026-32875
Component: ultrajson
CWE: CWE-190
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T01:35:23.362000+00:00

A flaw was found in UltraJSON, a fast JSON encoder and decoder. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted large positive or negative indent value to the JSON serialization functions. This can lead to a buffer overflow, causing the Python interpreter to crash, or an infinite loop, making the application unresponsive. The issue stems from an integer overflow or underflow during memory allocation for indentation.

Statement: This is an IMPORTANT denial of service flaw in UltraJSON, affecting Red Hat products that utilize `python-ujson`, including various Community Projects and Red Hat OpenStack Platform. The vulnerability arises when applications process untrusted input that controls the `indent` parameter in JSON serialization functions, potentially leading to a Python interpreter crash or an infinite loop. Exploitation requires a service to explicitly expose the `indent` parameter to untrusted users without proper validation.

Remediation:
To mitigate this issue, applications utilizing `python-ujson` should ensure that the `indent` parameter in `ujson.dump()`, `ujson.dumps()`, or `ujson.encode()` functions is not controlled by untrusted input. If untrusted input must influence indentation, restrict the `indent` value to reasonably small, non-negative integers. Review application code to identify and validate all uses of the `indent` parameter with external data.
Heap buffer overflow in CSS
CVE: CVE-2026-4442
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A heap buffer overflow flaw was found in the CSS component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=484751092

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
netfilter: nf_tables: unconditionally bump set->nelems before insertion
CVE: CVE-2026-23272
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter nf_tables component. A race condition occurs when elements are inserted into a full set, causing an element to be removed without proper synchronization with Read-Copy-Update (RCU) readers. This can allow a local attacker to trigger a use-after-free vulnerability, potentially leading to a denial of service or other unspecified impacts.

Statement: This vulnerability affects systems using nf_tables for packet filtering with sets that have size limits. When a set reaches capacity, the race between element insertion/removal and RCU readers creates a window for use-after-free. Exploitation requires the ability to configure nf_tables rules, which typically requires CAP_NET_ADMIN privileges or root access.

Remediation:
Vaadin flow-server: Authentication bypass due to inconsistent path matching allows unauthorized session creation.
CVE: CVE-2026-2742
Component: com.vaadin/flow-server
CWE: CWE-551
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-03-10T12:08:48.738000+00:00

A flaw was found in com.vaadin/flow-server. This authentication bypass vulnerability allows an unauthenticated attacker to bypass security filters by accessing the /VAADIN endpoint without a trailing slash. This inconsistent path pattern matching enables the attacker to trigger framework initialization and create sessions without proper authorization, potentially leading to unauthorized access and information disclosure.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in WebML
CVE: CVE-2026-3915
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

A heap buffer overflow flaw was found in the WebML component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=483971526

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
CVE: CVE-2026-0790
Component: ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability
Release date: 2026-01-09T15:55:29.387000+00:00

ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. By navigating directly to a URL, a user can gain unauthorized access to data. An attacker can leverage this vulnerability to disclose information in the context of the device. Was ZDI-CAN-28299.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
go-git: Data integrity issue due to improper verification of pack and index files
CVE: CVE-2026-25934
Component: go-git/go-git
CWE: CWE-354
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-02-09T22:13:41.974000+00:00

A flaw was found in go-git, a library for Git implementation in Go. This vulnerability allows a remote attacker to provide specially crafted Git pack or index files that are not properly verified for data integrity. Successful exploitation could lead to the go-git library processing corrupted data, which may result in unexpected application errors such as 'object not found'.


Remediation:
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
CVE: CVE-2026-23049
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel

The connector type for the DataImage SCF0700C48GGU18 panel is missing and
devm_drm_panel_bridge_add() requires connector type to be set. This leads
to a warning and a backtrace in the kernel log and panel does not work:
"
WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
"
The warning is triggered by a check for valid connector type in
devm_drm_panel_bridge_add(). If there is no valid connector type
set for a panel, the warning is printed and panel is not added.
Fill in the missing connector type to fix the warning and make
the panel operational once again.


Remediation:
arp: do not assume dev_hard_header() does not change skb->head
CVE: CVE-2026-22988
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's ARP implementation. The arp_create() function initializes a pointer to the ARP header before calling dev_hard_header(), incorrectly assuming that skb->head will not change. A recent kernel change broke this assumption, causing the @arp pointer to reference stale memory after dev_hard_header() potentially reallocates the socket buffer.

Statement: This vulnerability was introduced by a recent kernel change that modified dev_hard_header() behavior. The stale pointer access could lead to memory corruption or information disclosure during ARP packet creation. The issue affects network operations but requires specific device driver behavior to trigger the buffer reallocation.

Remediation:
External Secrets Operator: Cross-Namespace Secret Disclosure via `getSecretKey` Function
CVE: CVE-2026-22822
Component: external-secrets
CWE: CWE-863
Severity: Important
CVSS v3: 8.5/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-01-21T21:22:05.249000+00:00

A flaw was found in the External Secrets Operator. A user with appropriate permissions could exploit a vulnerability in the `getSecretKey` template function. This function allowed secrets, which are sensitive pieces of information like passwords or API keys, to be retrieved from other isolated environments (known as namespaces) within OpenShift Container Platform, bypassing security mechanisms. This could lead to unauthorized access and disclosure of sensitive data.

Statement: This vulnerability is rated Important for Red Hat products, including External Secrets Operator for Red Hat OpenShift. The `getSecretKey` template function in affected versions of External Secrets Operator allows a user with an authenticated account to retrieve secrets from other Kubernetes namespaces, bypassing security controls. While this could lead to unauthorized disclosure of sensitive data, an attacker needs to already have valid login credentials.

Remediation:
To mitigate this issue, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of the `getSecretKey` function within any `ExternalSecret` resource. This will block the vulnerable function from being exploited. Applying such policies may require restarting affected pods or services for the changes to take effect.
Kernel: Denial of Service and potential memory corruption via mmcid mode switch race condition
CVE: CVE-2026-23225
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched/mmcid: Don't assume CID is CPU owned on mode switch

Shinichiro reported a KASAN UAF, which is actually an out of bounds access
in the MMCID management code.

   CPU0						CPU1
   						T1 runs in userspace
   T0: fork(T4) -> Switch to per CPU CID mode
         fixup() set MM_CID_TRANSIT on T1/CPU1
   T4 exit()
   T3 exit()
   T2 exit()
						T1 exit() switch to per task mode
						 ---> Out of bounds access.

As T1 has not scheduled after T0 set the TRANSIT bit, it exits with the
TRANSIT bit set. sched_mm_cid_remove_user() clears the TRANSIT bit in
the task and drops the CID, but it does not touch the per CPU storage.
That's functionally correct because a CID is only owned by the CPU when
the ONCPU bit is set, which is mutually exclusive with the TRANSIT flag.

Now sched_mm_cid_exit() assumes that the CID is CPU owned because the
prior mode was per CPU. It invokes mm_drop_cid_on_cpu() which clears the
not set ONCPU bit and then invokes clear_bit() with an insanely large
bit number because TRANSIT is set (bit 29).

Prevent that by actually validating that the CID is CPU owned in
mm_drop_cid_on_cpu().

Statement: A local race in the sched mmcid mode switch path can lead to an out of bounds bit operation when a task exits with the MM_CID_TRANSIT flag still set and the code incorrectly assumes the CID is CPU owned. This can cause clear_bit to be called with an extremely large bit index which can crash the kernel and may corrupt kernel memory. For the CVSS the PR is L because a normal local user can create and exit tasks and potentially hit the timing window during CID mode transitions. The issue is not network reachable and requires local execution on the host. Impact is at least denial of service due to a kernel crash. A conservative worst case also considers possible integrity and confidentiality impact if the out of bounds write can be steered into sensitive memory.

Remediation:
Insufficient policy enforcement in Network
CVE: CVE-2026-0905
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-01-13T00:00:00+00:00

Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain potentially sensitive information via a network log file. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Team Admin Privilege Escalation to Demote Members to Guest
CVE: CVE-2026-26230
Component: github.com/mattermost/mattermost-server
CVSS v3: 4.8/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-16T20:19:51.287000+00:00

A permissions validation flaw has been discovered in mattermost server. Affected versions fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
null_blk: fix kmemleak by releasing references to fault configfs items
CVE: CVE-2026-23032
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix kmemleak by releasing references to fault configfs items

When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk
driver sets up fault injection support by creating the timeout_inject,
requeue_inject, and init_hctx_fault_inject configfs items as children
of the top-level nullbX configfs group.

However, when the nullbX device is removed, the references taken to
these fault-config configfs items are not released. As a result,
kmemleak reports a memory leak, for example:

unreferenced object 0xc00000021ff25c40 (size 32):
  comm "mkdir", pid 10665, jiffies 4322121578
  hex dump (first 32 bytes):
    69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f  init_hctx_fault_
    69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00  inject..........
  backtrace (crc 1a018c86):
    __kmalloc_node_track_caller_noprof+0x494/0xbd8
    kvasprintf+0x74/0xf4
    config_item_set_name+0xf0/0x104
    config_group_init_type_name+0x48/0xfc
    fault_config_init+0x48/0xf0
    0xc0080000180559e4
    configfs_mkdir+0x304/0x814
    vfs_mkdir+0x49c/0x604
    do_mkdirat+0x314/0x3d0
    sys_mkdir+0xa0/0xd8
    system_call_exception+0x1b0/0x4f0
    system_call_vectored_common+0x15c/0x2ec

Fix this by explicitly releasing the references to the fault-config
configfs items when dropping the reference to the top-level nullbX
configfs group.

Statement: null_blk fault injection configfs items were not released on device removal, causing a memory leak that can accumulate over repeated create and delete cycles. PR:H is typically required to manage configfs and null_blk devices, and the issue is not network reachable. Impact is denial of service via resource exhaustion.

Remediation:
h3: HTTP Request Smuggling due to improper case-sensitive parsing of Transfer-Encoding header
CVE: CVE-2026-23527
Component: h3
CVSS v3: 8.8/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Release date: 2026-01-15T19:24:20.514000+00:00

A flaw was found in h3, a minimal HTTP (Hypertext Transfer Protocol) framework. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request where the Transfer-Encoding header uses a case variation of "chunked". The readRawBody function performs a strict case-sensitive check for this header, which violates the RFC standard requiring case-insensitivity. This improper parsing can lead to HTTP Request Smuggling, potentially allowing attackers to bypass security controls, poison web caches, or conduct other malicious activities.

Statement: This vulnerability is rated Important for Red Hat products as it affects the h3 HTTP framework, which is used in Fedora 42 and 43. A remote attacker can exploit this flaw by sending a specially crafted HTTP request with a case-variant `Transfer-Encoding` header, leading to HTTP Request Smuggling. This can enable attackers to bypass security controls and poison web caches.

Remediation:
dottie.js: Unauthorized object modification via prototype pollution bypass
CVE: CVE-2026-27837
Component: dottie.js
CWE: CWE-915
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-02-26T00:19:24.289000+00:00

A flaw was found in dottie.js, a JavaScript library for nested object access and manipulation. An incomplete fix for a previous vulnerability allows a remote attacker to bypass prototype pollution protection by placing '__proto__' at any position other than the first in a dot-separated path. This vulnerability affects the `dottie.set()` and `dottie.transform()` functions. Successful exploitation can lead to unauthorized modification of object properties, potentially causing unexpected application behavior, information disclosure, or denial of service.


Remediation: