huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
jsPDF: Cross-User Data Leakage via race condition in addJS method
CVE: CVE-2026-24040
Component: jsPDF
CWE: CWE-820
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Release date: 2026-02-02T20:38:24.732000+00:00

A flaw was found in jsPDF. When jsPDF is used in a concurrent environment, such as a Node.js web server, a race condition in the addJS method can lead to cross-user data leakage. This occurs because a shared variable used to store JavaScript content can be overwritten by simultaneous requests. As a result, a PDF generated for one user may contain sensitive JavaScript content intended for another user, leading to unauthorized information disclosure.

Statement: This MODERATE impact vulnerability in jsPDF affects applications utilizing the `addJS` method in a concurrent server-side Node.js environment. A shared module-scoped variable can lead to cross-user data leakage when multiple PDF generation requests occur simultaneously, potentially embedding sensitive data from one user into another's PDF. This primarily impacts server-side deployments where jsPDF is used to generate documents concurrently.

Remediation:
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
FreeRDP: Denial of service via heap use-after-free during auto-reconnect
CVE: CVE-2026-25997
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-25T20:38:40.483000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
bpf, test_run: Subtract size of xdp_frame from allowed metadata size
CVE: CVE-2026-23140
Component: kernel
CWE: CWE-457
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf, test_run: Subtract size of xdp_frame from allowed metadata size

The xdp_frame structure takes up part of the XDP frame headroom,
limiting the size of the metadata. However, in bpf_test_run, we don't
take this into account, which makes it possible for userspace to supply
a metadata size that is too large (taking up the entire headroom).

If userspace supplies such a large metadata size in live packet mode,
the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call
will fail, after which packet transmission proceeds with an
uninitialised frame structure, leading to the usual Bad Stuff.

The commit in the Fixes tag fixed a related bug where the second check
in xdp_update_frame_from_buff() could fail, but did not add any
additional constraints on the metadata size. Complete the fix by adding
an additional check on the metadata size. Reorder the checks slightly to
make the logic clearer and add a comment.

Statement: A flaw exists in bpf_prog_test_run_xdp when running XDP programs via the bpf_test_run interface in live packet mode. The XDP frame headroom is shared between user supplied metadata and internal bookkeeping struct ures such as struct xdp_frame. Prior to this change, the test_run path validated metadata size without subtracting the space required by struct xdp_frame. As  a result, userspace could provide a metadata length large enough to consume the entire headroom. In live packet mode this can cause xdp_update_frame_from_buff called from xdp_test_run_init_page to fail. After that failure, the code could proceed with packet transmission while the xdp_frame structure remained uninitialized. Using an uninitialized frame in the transmit path can lead to kernel crashes and severe instability, resulting in a denial of service.

Remediation:
Calibre: Arbitrary file write via crafted RocketBook (.rb) file
CVE: CVE-2026-30853
Component: calibre
CVSS v3: 4.9/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Release date: 2026-03-13T19:00:09.925000+00:00

A flaw was found in Calibre, an e-book manager. A path traversal vulnerability in the RocketBook (.rb) input plugin allows an attacker to write arbitrary files to any location accessible by the Calibre process. This can be exploited when a user opens or converts a specially crafted .rb file, potentially leading to information disclosure, denial of service, or arbitrary code execution.

Statement: This vulnerability has a MODERATE impact. A path traversal flaw in the RocketBook (.rb) input plugin of calibre allows an attacker to write arbitrary files to locations writable by the calibre process. This issue occurs when a user opens or converts a specially crafted .rb file.

Remediation:
rethinkdb: Arbitrary code execution via buffer overflow
CVE: CVE-2026-24810
Component: rethinkdb
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-01-27T08:47:02.459000+00:00

A flaw was found in rethinkdb. Commonly known as a classic buffer overflow, the vulnerability allows a remote, unauthenticated attacker to provide specially crafted input. Successful exploitation can lead to arbitrary code execution, granting the attacker full control over the affected system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Preact: Arbitrary script execution via JSON serialization protection bypass
CVE: CVE-2026-22028
Component: preact
CWE: CWE-843
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-08T14:16:22.461000+00:00

A flaw was found in Preact, a lightweight web development framework. A security regression allows an attacker to bypass JSON serialization protection, leading to HTML injection. This vulnerability arises when applications process unsanitized data from external sources, allowing malicious JSON to be interpreted as valid user interface elements. If exploited, this could enable arbitrary script execution, potentially compromising user data or system integrity.

Statement: This vulnerability is rated Moderate for Red Hat because it requires applications to process unsanitized, user-modifiable JSON data directly into the render tree, assuming it to be strings. This specific configuration is not common in Red Hat products by default. Red Hat AMQ, Red Hat Ansible Automation Platform, OpenShift Lightspeed, OpenShift Container Platform, Red Hat Enterprise Linux, Red Hat In-Vehicle OS, Red Hat OpenShift AI (RHOAI), Ansible Services, Hosted OpenShift, and cloud.redhat.com are affected if they meet the described conditions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
pnpm symlink traversal in file:/git dependencies
CVE: CVE-2026-24056
Component: pnpm
CWE: CWE-59
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-01-26T21:59:32.287000+00:00

pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) causes pnpm to copy that file's contents into `node_modules`, leaking local data. The vulnerability only affects `file:` and `git:` dependencies. Registry packages (npm) have symlinks stripped during publish and are NOT affected. The issue impacts developers installing local/file dependencies andCI/CD pipelines installing git dependencies. It can lead to credential theft via symlinks to `~/.aws/credentials`, `~/.npmrc`, `~/.ssh/id_rsa`. Version 10.28.2 contains a patch.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Out of bounds read and write in WebAudio
CVE: CVE-2026-4459
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An out of bounds read and write flaw was found in the WebAudio component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=490246422

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
apparmor: validate DFA start states are in bounds in unpack_pdb
CVE: CVE-2026-23269
Component: kernel
Severity: None
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
ice: add missing ice_deinit_hw() in devlink reinit path
CVE: CVE-2026-23117
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Intel ice network driver. When performing a devlink-reload operation, the ice_devlink_reinit_down() function fails to call ice_deinit_hw() to properly uninitialize the hardware control queues. This causes the subsequent ice_init_hw() call to fail with -EBUSY. If the driver is then removed, a NULL pointer dereference occurs in ice_unload(), leading to a kernel crash.

Statement: Triggering this flaw requires administrator privileges to perform devlink-reload operations, followed by driver removal. The vulnerability is specific to the ice driver used with Intel Ethernet 800 Series adapters and requires a specific sequence of administrative operations.
The kernel crash can occur in the Intel ice driver when using the devlink reload workflow. A prior change removed a deinitialization call from a shared deinit helper. As a consequence the devlink reinit down path 
no longer deinitialized the hardware control queues via ice_deinit_hw. The devlink reinit up path still calls ice_init_hw. With control queues left initialized the subsequent init can fail with -EBUSY. After this inconsistent state a later device removal or module unload can hit a NULL pointer dereference in the ice unload remove path, resulting in a local denial of service. Triggering conditions require local access capable of invoking devlink reload operations, which typically maps to administrative privileges such as CAP_NET_ADMIN.

Remediation:
To mitigate this issue, prevent the ice module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.
Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
CVE: CVE-2026-1525
Component: undici
CWE: CWE-444
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2026-03-12T19:56:55.092000+00:00

A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., "Content-Length" and "content-length"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-0764
Component: GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-01-09T16:35:01.799000+00:00

GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the upload endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27957.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component
CVE: CVE-2026-2759
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:32:59.173000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the Graphics: ImageLib component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ftrace: Do not over-allocate ftrace memory
CVE: CVE-2026-23052
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Do not over-allocate ftrace memory

The pg_remaining calculation in ftrace_process_locs() assumes that
ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the
allocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE
(integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g.
4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages)
have significantly more capacity than 256 * 170. This leads to pg_remaining
being underestimated, which in turn makes skip (derived from skipped -
pg_remaining) larger than expected, causing the WARN(skip != remaining)
to trigger.

Extra allocated pages for ftrace: 2 with 654 skipped
WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0

A similar problem in ftrace_allocate_records() can result in allocating
too many pages. This can trigger the second warning in
ftrace_process_locs().

Extra allocated pages for ftrace
WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580

Use the actual capacity of a page group to determine the number of pages
to allocate. Have ftrace_allocate_pages() return the number of allocated
pages to avoid having to calculate it. Use the actual page group capacity
when validating the number of unused pages due to skipped entries.
Drop the definition of ENTRIES_PER_PAGE since it is no longer used.

Statement: ftrace page group capacity was miscalculated because ENTRIES_PER_PAGE used integer division of PAGE_SIZE by ENTRY_SIZE which underestimates the true capacity when PAGE_SIZE is not a multiple of ENTRY_SIZE. With higher order allocations this makes pg_remaining too small and inflates the computed skip value which can trigger WARN conditions in ftrace_process_locs. The same logic can also lead to allocating more pages than necessary for ftrace records which wastes memory and may contribute to resource pressure. For the CVSS the PR is L in the paranoid score because some systems allow non root tracing in containers or expose tracing controls to service accounts. In typical production systems PR is H because enabling and configuring ftrace generally requires administrative privileges. The issue is not network reachable. Impact is primarily availability through memory waste and potential instability from repeated warnings.

Remediation:
PDF object injection via unsanitized input in addJS method
CVE: CVE-2026-25755
Component: jsPDF
CWE: CWE-94
Severity: Important
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-02-19T14:41:46.941000+00:00

A flaw was found in jsPDF. The addJS method accepts user input without proper sanitization, allowing an attacker to inject arbitrary PDF objects into the document. A specially crafted payload that escapes the JavaScript string delimiter can execute malicious actions or alter the document structure, resulting in arbitrary code execution when a user opens a PDF with a viewer that supports embedded scripts.

Statement: To exploit this flaw, an attacker must be able to supply a specially crafted payload to the application using the addJS method and convince a user to open the generated PDF document with a viewer that supports embedded scripts. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
To mitigate this vulnerability, sanitize the user-provided JavaScript code before passing it to the addJS method by strictly escaping backslashes and parentheses. Additionally, do not open PDF documents from untrusted sources.
idpf: Fix RSS LUT NULL ptr issue after soft reset
CVE: CVE-2026-22993
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: Fix RSS LUT NULL ptr issue after soft reset

During soft reset, the RSS LUT is freed and not restored unless the
interface is up. If an ethtool command that accesses the rss lut is
attempted immediately after reset, it will result in NULL ptr
dereference. Also, there is no need to reset the rss lut if the soft reset
does not involve queue count change.

After soft reset, set the RSS LUT to default values based on the updated
queue count only if the reset was a result of a queue count change and
the LUT was not configured by the user. In all other cases, don't touch
the LUT.

Steps to reproduce:

** Bring the interface down (if up)
ifconfig eth1 down

** update the queue count (eg., 27->20)
ethtool -L eth1 combined 20

** display the RSS LUT
ethtool -x eth1

[82375.558338] BUG: kernel NULL pointer dereference, address: 0000000000000000
[82375.558373] #PF: supervisor read access in kernel mode
[82375.558391] #PF: error_code(0x0000) - not-present page
[82375.558408] PGD 0 P4D 0
[82375.558421] Oops: Oops: 0000 [#1] SMP NOPTI
<snip>
[82375.558516] RIP: 0010:idpf_get_rxfh+0x108/0x150 [idpf]
[82375.558786] Call Trace:
[82375.558793]  <TASK>
[82375.558804]  rss_prepare.isra.0+0x187/0x2a0
[82375.558827]  rss_prepare_data+0x3a/0x50
[82375.558845]  ethnl_default_doit+0x13d/0x3e0
[82375.558863]  genl_family_rcv_msg_doit+0x11f/0x180
[82375.558886]  genl_rcv_msg+0x1ad/0x2b0
[82375.558902]  ? __pfx_ethnl_default_doit+0x10/0x10
[82375.558920]  ? __pfx_genl_rcv_msg+0x10/0x10
[82375.558937]  netlink_rcv_skb+0x58/0x100
[82375.558957]  genl_rcv+0x2c/0x50
[82375.558971]  netlink_unicast+0x289/0x3e0
[82375.558988]  netlink_sendmsg+0x215/0x440
[82375.559005]  __sys_sendto+0x234/0x240
[82375.559555]  __x64_sys_sendto+0x28/0x30
[82375.560068]  x64_sys_call+0x1909/0x1da0
[82375.560576]  do_syscall_64+0x7a/0xfa0
[82375.561076]  ? clear_bhb_loop+0x60/0xb0
[82375.561567]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
<snip>

Statement: A NULL pointer dereference can be triggered in the idpf driver when an ethtool command accesses the RSS indirection table immediately after a soft reset, as the RSS LUT may have been freed but not reinitialized. This results in a reliable kernel crash and constitutes a local denial-of-service condition, typically requiring CAP_NET_ADMIN privileges.

Remediation:
FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library
CVE: CVE-2026-29776
Component: freerdp
CWE: CWE-190
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-13T17:33:10.360000+00:00

An integer underflow flaw has been discovered in FreeRDP. A uint32 field is populated from a uint16 data element. This field is later modified without proper checks and in some situations a program crash may occur.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling
CVE: CVE-2026-2923
Component: GStreamer
CWE: CWE-787
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:39:01.199000+00:00

A flaw was found in GStreamer. This out-of-bounds write vulnerability in the DVB (Digital Video Broadcasting) Subtitles handling allows remote attackers to execute arbitrary code. The issue stems from improper validation of user-supplied coordinate data, which can lead to writing beyond the boundaries of an allocated memory buffer. Successful exploitation can result in arbitrary code execution within the context of the current process.

Statement: IMPORTANT: A vulnerability in GStreamer's DVB subtitles component allows remote code execution due to an out-of-bounds write caused by improper validation of user-supplied data. This affects Red Hat Enterprise Linux versions that include GStreamer. Exploitation requires interaction with the GStreamer library, typically through processing malicious DVB subtitle streams.

Remediation:
To mitigate this issue, avoid processing untrusted DVB subtitle streams with GStreamer. Limiting exposure to untrusted content can reduce the risk of exploitation.