huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Mongoose: Remote Denial of Service in TCP Sequence Number Handler
CVE: CVE-2026-2967
Component: Mongoose
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-23T02:32:07.568000+00:00

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
uTLS: TLS 1.3 downgrade protection bypass allows information disclosure and fingerprinting
CVE: CVE-2026-26994
Component: utls
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-02-20T02:50:18.439000+00:00

A flaw was found in uTLS. An active network attacker could exploit this vulnerability by manipulating the initial connection message (ClientHello) during the TLS handshake. This manipulation forces a downgrade from the more secure TLS 1.3 protocol to an older, less secure version like TLS 1.2. As a result, the client would accept the weaker connection without detecting the attack, potentially leading to information disclosure or allowing the attacker to identify uTLS connections.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SQL injection in DuckDB export via unparameterized DDL statements
CVE: CVE-2026-32611
Component: glances
CVSS v3: 6.9/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Release date: 2026-03-18T17:21:18.668000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel (mlx5e): Denial of Service due to NULL pointer dereference during network profile change
CVE: CVE-2026-23000
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

A flaw was found in the Linux kernel's mlx5e network driver. A local user can exploit this vulnerability by repeatedly attempting to change the network profile, such as enabling switchdev mode, after an initial failure to apply or roll back the profile. This can lead to a NULL pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).


Remediation:
heap-based buffer overflow via integer overflow in mem_size calculation (bypass of CVE-2025-53630 fix)
CVE: CVE-2026-27940
Component: llama.cpp
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-12T16:39:37.463000+00:00

A flaw was found in llama.cpp. A integer overflow can occur in the gguf_init_from_file_impl function in the gguf.cpp file, leading to an undersized heap allocation. A subsequent fread function call can write 528+ bytes of attacker controlled data past the buffer boundary. This issue is a bypass of CVE-2025-53630.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
CVE: CVE-2026-23903
Component: org.apache.shiro/shiro-web
CWE: CWE-289
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-09T09:26:21.772000+00:00

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem,
such as default macOS setup, static files may be accessed by varying the case of the filename in the request.
If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.0.7 and later has a new parameters to remediate this issue
shiro.ini: filterChainResolver.caseInsensitive = true
application.propertie: shiro.caseInsensitive=true

Shiro 3.0.0 and later (upcoming) makes this the default.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
CVE: CVE-2026-23145
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's ext4 filesystem. In the ext4_xattr_inode_update_ref() function, the error handling path fails to release the buffer head reference (iloc.bh). This causes a buffer head leak on each error occurrence, which over time can lead to memory exhaustion and system instability.

Statement: This flaw was discovered through code review and affects ext4 filesystems when extended attribute inode reference updates fail. The memory leak accumulates only during error conditions in xattr operations, limiting its practical impact under normal usage. Systems using ext4 with heavy extended attribute usage may be more susceptible.

Remediation:
FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
CVE: CVE-2026-24680
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:19:45.222000+00:00

A heap buffer use after free has been discovered in FreeRDP. sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering a program crash.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Locutus: Arbitrary code execution via unsanitized parameters in create_function
CVE: CVE-2026-32304
Component: locutusjs
CWE: CWE-88
Severity: Important
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-12T21:24:51.730000+00:00

A flaw was found in Locutus, a JavaScript library that provides standard library functions. The `create_function` function in Locutus passes user-supplied arguments and code directly to the JavaScript `Function` constructor without proper sanitization. This vulnerability allows a remote attacker to execute arbitrary code within the application, potentially leading to full system compromise or data manipulation.


Remediation:
Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator
CVE: CVE-2026-28420
Component: vim
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2026-02-27T22:04:36.189000+00:00

A flaw was found in Vim. A remote attacker could exploit a heap-based buffer overflow and an out-of-bounds read vulnerability in Vim's terminal emulator. This occurs when processing specially crafted Unicode supplementary plane characters, potentially leading to information disclosure and denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64
CVE: CVE-2026-24116
Component: wasmtime
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-27T18:58:52.349000+00:00

Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests. Wasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions are not patched and users should updated to supported major version instead. This bug can be worked around by enabling signals-based-traps. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Python: Command-line option injection in webbrowser.open() via crafted URLs
CVE: CVE-2026-4519
Component: python
CWE: CWE-88
Severity: Important
CVSS v3: 7.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2026-03-20T15:08:32.576000+00:00

A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
container image templating arbitrary host file read and write
CVE: CVE-2026-23954
Component: incus
CVSS v3: 8.5/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Release date: 2026-01-22T21:45:55.696000+00:00

Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the host. When using an image with a metadata.yaml containing templates, both the source and target paths are not checked for symbolic links or directory traversal. This can also be exploited in IncusOS. A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition
CVE: CVE-2026-1035
Component: org.keycloak.protocol.oidc
CWE: CWE-367
Severity: Low
CVSS v3: 3.2/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-01-21T00:00:00+00:00

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.

Statement: This vulnerability is rated LOW for Red Hat. A race condition in the Keycloak TokenManager allows an attacker to bypass the refreshTokenMaxReuse security policy when it is explicitly configured for strict single-use (set to zero). This enables a single refresh token to be exchanged for multiple valid access tokens through concurrent requests, undermining the Refresh Token Rotation hardening measure.

Remediation:
To mitigate this issue, configure the `refreshTokenMaxReuse` policy in Keycloak to a value greater than zero. This prevents the race condition by allowing a limited number of reuses for refresh tokens, thereby maintaining the integrity of the Refresh Token Rotation hardening measure. Consult Keycloak documentation for specific configuration instructions. Changes to Keycloak configuration typically require a service restart or redeployment to take effect.
vsock/virtio: Coalesce only linear skb
CVE: CVE-2026-23057
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Coalesce only linear skb

vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb
(with a spare tail room) is followed by a small skb (length limited by
GOOD_COPY_LEN = 128), an attempt is made to join them.

Since the introduction of MSG_ZEROCOPY support, assumption that a small skb
will always be linear is incorrect. In the zerocopy case, data is lost and
the linear skb is appended with uninitialized kernel memory.

Of all 3 supported virtio-based transports, only loopback-transport is
affected. G2H virtio-transport rx queue operates on explicitly linear skbs;
see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G
vhost-transport may allocate non-linear skbs, but only for sizes that are
not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in
virtio_vsock_alloc_skb().

Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0
guarantees last_skb is linear.

Statement: A kernel information leak can occur in the vsock virtio common receive path when small packets are coalesced into the last skb in the RX queue. The coalescing logic assumed that a small skb is always linear. After MSG_ZEROCOPY support, a small skb can be non linear and carry its payload in skb_shinfo fragments. In that case, copying from the skb linear area can append uninitialized kernel memory to the accumulated skb. This can expose kernel memory contents to userspace through the vsock socket receive API. For the CVSS the PR is typically L because an attacker needs local access to create vsock connections and use MSG_ZEROCOPY on the affected transport path. The issue is not generally network reachable. Impact is information disclosure. It may aid exploitation by leaking pointers or other sensitive data but it is not a direct privilege escalation by itself.

Remediation:
HTSlib: CRAM decoder has a heap buffer overflow
CVE: CVE-2026-31969
Component: htslib
CVSS v3: 7.3/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2026-03-18T19:47:44.893000+00:00

A flaw was found in HTSlib, a library used for bioinformatics file formats. A remote attacker could exploit an out-by-one error when processing a specially crafted CRAM (Compressed Reference-oriented Alignment Map) file. This vulnerability can lead to a heap buffer overflow, potentially allowing for arbitrary code execution, data corruption, or causing the program to crash. This poses a significant risk to the integrity and availability of systems handling bioinformatics data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
giflib: Denial of Service via buffer overflow in EGifGCBToExtension
CVE: CVE-2026-26740
Component: giflib
CWE: CWE-787
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in giflib. A remote attacker can exploit a buffer overflow vulnerability in the EGifGCBToExtension function by providing a specially crafted Graphics Control Extension (GCE) block. This allows overwriting an existing GCE block without proper size validation, leading to a denial of service (DoS) on the system.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
CVE: CVE-2026-23112
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU
length or offset exceeds sg_cnt and then use bogus sg->length/offset
values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining
entries, and sg->length/offset before building the bvec.

Statement: An out of bounds access in the NVMe TCP target can occur in nvmet_tcp_build_pdu_iovec when a crafted PDU length or data offset causes sg_idx to exceed cmd req sg_cnt or causes iteration past the remaining scatterlist entries. This can make the code use bogus sg length and offset values and then crash in _copy_to_iter with a general protection fault or a KASAN report. For the CVSS the PR is N in the paranoid scenario because an attacker only needs network reachability to the NVMe TCP target listener and does not need local credentials on the victim. The issue is network reachable in environments that expose NVMe over TCP to initiators (usually in local networks or by VPN, so for the CVSS keeping AV:A). Impact is a reliable denial of service via kernel crash. In a conservative assessment memory corruption patterns may also be considered for potential confidentiality or integrity impact.

Remediation:
To mitigate this issue, prevent module nvmet-tcp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
CVE: CVE-2026-0761
Component: Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:31:11.647000+00:00

Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the actionoutput_str_to_mapping function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28124.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Cosign verification accepts any valid Rekor entry under certain conditions
CVE: CVE-2026-22703
Component: github.com/sigstore/cosign
CWE: CWE-345
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-01-10T06:11:09.426000+00:00

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libsoup: HTTP header injection and response splitting via CRLF injection in Content-Type header
CVE: CVE-2026-3634
Component: libsoup
CWE: CWE-93
Severity: Moderate
CVSS v3: 4.3/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-03-06T05:05:00+00:00

A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks.

Statement: This MODERATE impact flaw in libsoup allows an attacker to perform HTTP header injection and response splitting. By controlling the `Content-Type` header value, an attacker can inject arbitrary header-value pairs due to improper input sanitization in the `soup_message_headers_set_content_type()` function.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.