huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Kata Containers: Arbitrary code execution in guest virtual machine via file system modification
CVE: CVE-2026-24834
Component: containerd-shim-kata-v2
CWE: CWE-281
Severity: Important
CVSS v3: 9.2/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-19T15:57:50.691000+00:00

A flaw was found in Kata Containers. A user of a container can exploit this vulnerability by modifying the file system used by the Guest micro Virtual Machine (VM). This allows the attacker to achieve arbitrary code execution as root within the compromised Guest VM. This issue does not impact the security of the host or other containers/VMs running on the host.

Statement: This risk posed by this flaw is limited to the Guest VM provided to each Kata Containers container which exists as a second layer of isolation. This flaw has been rated Important because it requires an attacker to have local access to a container in order to execute arbitrary code.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
improper error handling when splitting UTF-8 strings in the HTML Cascading Style Sheets (CSS) module
CVE: CVE-2026-20031
Component: ClamAV
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-04T17:17:33.372000+00:00

A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Erlang OTP tftp_file modules: Information disclosure via relative path traversal
CVE: CVE-2026-21620
Component: erlang
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-02-20T10:57:08.620000+00:00

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.

Statement: This vulnerability has a LOW impact. A relative path traversal flaw in the Erlang/OTP TFTP modules could allow an attacker to access or write files outside the intended TFTP directory. This issue affects systems where the Erlang TFTP service is exposed and actively used.

Remediation:
Restrict network access to the TFTP service to trusted hosts using firewall rules. Ensure the TFTP server is configured to operate within a chroot environment to limit file system access. If the TFTP service is not required, disable it.
Example for disabling the TFTP service (if managed by systemd):
`sudo systemctl stop tftp.service`
`sudo systemctl disable tftp.service`
Restart the TFTP service after applying any configuration changes for them to take effect.
Integer Overflow Leading to Buffer Underflow and Out-of-Bounds Write in GLib g_base64_encode()
CVE: CVE-2026-1484
Component: Glib
CWE: CWE-787
Severity: Moderate
CVSS v3: 4.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2026-01-27T00:00:00+00:00

A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.

Statement: This vulnerability is rated Moderate for Red Hat products. The flaw in GLib's Base64 encoding implementation requires an application to pass excessively large or untrusted input to the g_base64_encode() API. Exploitation could lead to application crashes or memory corruption.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Unsafe Reflection in Mongoid::Criteria.from_hash
CVE: CVE-2026-2302
Component: rubygem-mongoid
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2026-02-10T18:59:23.760000+00:00

Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0780
Component: ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:52:00.262000+00:00

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28289.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTSlib: Information disclosure and Denial of Service via unvalidated CRAM mate reference ID
CVE: CVE-2026-31967
Component: htslib
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-03-18T19:15:48.891000+00:00

A flaw was found in HTSlib, a library used for bioinformatics file formats. When processing CRAM (Compressed Reference-oriented Alignment Map) records, the `cram_decode_slice()` function fails to validate the mate reference ID field. This oversight allows an attacker to craft a malicious CRAM file, which can lead to an out-of-bounds read during data conversion to SAM (Sequence Alignment/Map) format. The primary consequence of this vulnerability is the potential disclosure of sensitive program state information, and it may also cause a Denial of Service (DoS) by crashing the program.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
scsi: qla2xxx: Sanitize payload size to prevent member overflow
CVE: CVE-2026-23059
Component: kernel
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A buffer overflow vulnerability was found in the Linux kernel's QLogic qla2xxx Fibre Channel driver. The qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt() functions use firmware-reported frame_size to calculate copy length into item->iocb, a fixed 64-byte array. When frame_size exceeds 64 bytes, the memcpy operations overflow the iocb member boundary, writing into adjacent structure members.

Statement: This flaw affects systems with QLogic Fibre Channel HBAs using the qla2xxx driver. The overflow is triggered by malformed firmware responses containing oversized frame_size values. While CONFIG_FORTIFY_SOURCE detects and warns about the cross-member write, the practical security impact depends on what data overwrites adjacent structure members and whether attackers can control firmware responses.

Remediation:
To mitigate this issue, prevent the qla2xxx module from being loaded if QLogic Fibre Channel adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
Django: SQL injection via crafted column aliases in QuerySet.order_by()
CVE: CVE-2026-1312
Component: Django
CWE: CWE-89
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-03T14:36:23.257000+00:00

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the `.QuerySet.order_by()` method. This occurs when column aliases containing periods are used, and the same alias is also present in `FilteredRelation` via a specially crafted dictionary. Successful exploitation could lead to unauthorized information disclosure or arbitrary code execution within the database.

Statement: This IMPORTANT vulnerability in Django allows for SQL injection within the `QuerySet.order_by()` method. A remote attacker could exploit this by providing crafted column aliases that include periods, specifically when used with `FilteredRelation`. Successful exploitation may result in unauthorized information disclosure or arbitrary code execution against the underlying database. This affects Red Hat products that integrate Django, such as Red Hat Ansible Automation Platform and Red Hat Satellite.

Remediation:
For details on how to apply this update, refer to Ansible Automation Platform documentation.
For details on how to apply this update, refer to Ansible Automation Platform documentation.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Kernel: Denial of Service in network socket error handling
CVE: CVE-2026-22977
Component: kernel
CWE: CWE-489
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-21T13:08:54.858000+00:00

A flaw was found in the kernel. A local user could trigger a system crash, leading to a Denial of Service (DoS), due to improper handling of usercopy operations within the network socket error queue. This vulnerability arises when the kernel attempts to copy specific network buffer data to userspace without adequate validation, causing a hardened usercopy panic.


Remediation:
glibc: Information disclosure via zero-valued network query
CVE: CVE-2026-0915
Component: glibc
CWE: CWE-908
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-01-15T22:08:41.630000+00:00

A flaw was found in glibc, the GNU C Library. When an application calls the `getnetbyaddr` or `getnetbyaddr_r` functions to resolve a network address, and the system's `nsswitch.conf` file is configured to use a DNS (Domain Name System) backend for network lookups, a query for a zero-valued network can lead to the disclosure of stack memory contents. This information is leaked to the configured DNS resolver, potentially allowing an attacker who controls the resolver to gain sensitive data from the affected system.

Statement: This vulnerability is rated Moderate for Red Hat products. It allows for information disclosure of stack contents to a configured DNS resolver when an application utilizes `getnetbyaddr` or `getnetbyaddr_r` with a DNS backend specified in `nsswitch.conf` for a zero-valued network query. This affects Red Hat Enterprise Linux and OpenShift Container Platform.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
f2fs: fix out-of-bounds access in sysfs attribute read/write
CVE: CVE-2026-23235
Component: kernel
Severity: None
Release date: 2026-03-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix out-of-bounds access in sysfs attribute read/write

Some f2fs sysfs attributes suffer from out-of-bounds memory access and
incorrect handling of integer values whose size is not 4 bytes.

For example:
vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out
vm:~# cat /sys/fs/f2fs/vde/carve_out
65537
vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold
vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold
1

carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit
integer. However, the sysfs interface allows setting it to a value
larger than 255, resulting in an out-of-range update.

atgc_age_threshold maps to {struct atgc_management}->age_threshold,
which is a 64-bit integer, but its sysfs interface cannot correctly set
values larger than UINT_MAX.

The root causes are:
1. __sbi_store() treats all default values as unsigned int, which
prevents updating integers larger than 4 bytes and causes out-of-bounds
writes for integers smaller than 4 bytes.

2. f2fs_sbi_show() also assumes all default values are unsigned int,
leading to out-of-bounds reads and incorrect access to integers larger
than 4 bytes.

This patch introduces {struct f2fs_attr}->size to record the actual size
of the integer associated with each sysfs attribute. With this
information, sysfs read and write operations can correctly access and
update values according to their real data size, avoiding memory
corruption and truncation.


Remediation:
OliveTin: Remote Code Execution via shell metacharacter injection and webhook processing
CVE: CVE-2026-27626
Component: olivetin
CVSS v3: 9.6/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-25T02:43:08.189000+00:00

A flaw was found in OliveTin. This vulnerability allows an authenticated user to inject shell metacharacters through `password`-typed arguments, leading to arbitrary operating system command execution. Additionally, an unauthenticated attacker can achieve Remote Code Execution (RCE) by sending specially crafted webhook-extracted JSON values that bypass safety checks. Both vectors enable an attacker to execute arbitrary commands on the OliveTin host with the permissions of the OliveTin process.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference when parsing a malformed MOL2 file
CVE: CVE-2026-2705
Component: openbabel
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-19T05:02:07.101000+00:00

A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in the library include/openbabel/atom.h of the component MOL2 File Handler. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer overflow in WebCodecs
CVE: CVE-2026-3544
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Cilium: Information disclosure via incorrect traffic permitting with specific network configurations
CVE: CVE-2026-26963
Component: cilium
CWE: CWE-266
Severity: Moderate
CVSS v3: 6.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-02-19T23:38:36.110000+00:00

A flaw was found in Cilium. When specific network configurations, including Native Routing, WireGuard, and Node Encryption, are enabled, Cilium incorrectly allows network traffic from Pods on other nodes. This can lead to unauthorized access to network communications and potential information disclosure.


Remediation:
Integer overflow in ANGLE
CVE: CVE-2026-4452
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An integer overflow flaw was found in the ANGLE component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=487977696

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
gve: Fix stats report corruption on queue count change
CVE: CVE-2026-23262
Component: kernel
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A memory corruption vulnerability was found in the Linux kernel's Google Virtual Ethernet (gve) driver. The driver and NIC share a memory region for statistics reporting, with the NIC calculating its write offset based on the region size. When queue count is increased, the driver resizes the stats region, but the NIC continues using the old offset calculation, causing out-of-bounds writes past the allocated buffer and corrupting kernel memory.

Statement: This flaw affects Google Cloud Platform virtual machines using the gve network driver. Memory corruption occurs when the number of network queues is changed dynamically. The NIC's offset calculation becomes misaligned with the actual allocated buffer size, allowing the NIC hardware to write beyond the stats region. This is specific to GCP environments using Virtio-based networking with the gve driver.

Remediation:
live555: Remote Code Execution via segmentation fault in increaseBufferTo function
CVE: CVE-2026-1200
Component: live555
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-01-19T08:08:00+00:00

A flaw was found in the rgaufman/live555 fork of live555. A remote attacker could exploit a segmentation fault, in the `increaseBufferTo` function. This vulnerability can lead to memory corruption problems and potentially other consequences.

Statement: This vulnerability is rated Moderate for Red Hat products as it affects the `live555` library, which, when used in a server context, could lead to remote code execution due to a segmentation fault. Exploitation requires a service utilizing the vulnerable `increaseBufferTo` function to be exposed to an attacker.

Remediation:
PNG file MacOS.pm SetMacOSTags OS command injection
CVE: CVE-2026-3102
Component: exiftool
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T14:32:13.272000+00:00

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Valkey: Denial of Service via invalid clusterbus packet
CVE: CVE-2026-21863
Component: valkey
CWE: CWE-125
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-23T19:41:28.783000+00:00

A flaw was found in Valkey, a distributed key-value database. A malicious actor with access to the Valkey clusterbus port can exploit an input validation vulnerability by sending a specially crafted invalid clusterbus packet. This lack of validation for clusterbus ping extension packets can lead to an out-of-bounds read. Consequently, this may cause the system to crash, resulting in a Denial of Service (DoS).

Statement: This issue is rated High severity by Red Hat Product Security, because Valkey is commonly deployed as a network-accessible service or embedded within applications that accept remote input over standard network interfaces. In such environments, a remote attacker can trigger the vulnerability by sending specially crafted data to the service. Successful exploitation results in a service crash, leading to a denial-of-service condition. Although no confidentiality or integrity impacts are observed, the ability to repeatedly crash the service over the network justifies a High availability impact rating.

This vulnerability affects Valkey deployments where the cluster bus connection is exposed.

Remediation:
To mitigate this issue, restrict network access to the Valkey cluster bus port. Configure network access control lists (ACLs) or firewall rules to ensure that only trusted hosts can connect to the cluster bus port. This limits the attack surface by preventing unauthorized actors from sending malicious clusterbus packets.