huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-26960: node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation
Component: node-tar
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2026-02-20T01:07:52.979000+00:00

A flaw was found in node-tar. An attacker can craft a malicious archive that, when extracted with default options, creates a hardlink outside the intended extraction directory. This vulnerability allows the attacker to perform arbitrary file read and write operations as the user extracting the archive, bypassing existing path protections. This can lead to unauthorized access and modification of sensitive system files.

Statement: In Red Hat environments, this condition introduces a significant constraint, as exploitation requires user interaction and reliance on unsafe handling of externally supplied archives. The attack is not remotely exploitable in isolation and depends on a user or service processing attacker-controlled input.

Furthermore, the impact of the vulnerability is limited to the privileges of the extracting process. In typical Red Hat deployments, archive extraction is performed by non-privileged users or within confined environments such as containers or restricted service contexts, which limits the scope of potential damage.

Red Hat analysis also notes that this issue does not provide a direct mechanism for code execution or privilege escalation, but rather enables file system manipulation within the boundaries of the executing user’s permissions.

Given the requirement for user-assisted exploitation, the absence of a direct remote attack vector, and the confinement of impact to the privileges of the extracting process, Red Hat considers the practical risk to be lower than the generalized NVD assessment. As a result, this vulnerability is classified as Moderate severity.

Affected upstream versions: < 7.5.8
Fixed upstream versions: v7.5.8
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: 2cb1120bcefe28d7ecc719b41441ade59c52e384
CVE-2026-26965: freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path
Component: freerdp
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-02-25T20:59:17.828000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit a heap out-of-bounds write vulnerability in the `planar_decompress_plane_rle()` function. This vulnerability allows the server to write past the end of a temporary buffer, potentially overwriting critical data such as function pointers. This can lead to arbitrary code execution on the connecting FreeRDP client.


Affected upstream versions: < 3.23.0
Fixed upstream versions: 3.23.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: a0be5cb87d760bb1c803ad1bb835aa1e73e62abc
CVE-2026-26986: freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-25T21:01:16.916000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This double free vulnerability occurs during the cleanup process when a remote desktop session disconnects. Specifically, if a title allocation fails, a pointer to an application window is freed but not removed from a tracking table. Later, during disconnection, the same pointer is freed again, which can lead to a crash and result in a denial of service.


Affected upstream versions: < 3.23.0
Fixed upstream versions: 3.23.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51
CVE-2026-26996: minimatch: minimatch: Denial of Service via specially crafted glob patterns
Component: minimatch
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-02-20T03:05:21.105000+00:00

A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.

Statement: Exploitation of this flaw requires that a user or service processes untrusted input.

Affected upstream versions: < 10.2.1
Fixed upstream versions: v10.2.1
Upstream repository: https://github.com/isaacs/minimatch
Upstream fix commit: 2e111f3a79abc00fa73110195de2c0f2351904f5
CVE-2026-27135: nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination
Component: nghttp2
Severity: Important
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-18T17:59:02.045000+00:00

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).


Affected upstream versions: < 1.68.1
Fixed upstream versions: v1.68.1
Upstream repository: https://github.com/nghttp2/nghttp2
Upstream fix commit: 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1
CVE-2026-27447: cups: OpenPrinting CUPS: Authorization bypass via case-insensitive username comparison
Component: cups
Severity: Moderate
CWE: CWE-178 (Improper Handling of Case Sensitivity)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Public date: 2026-04-03T21:11:59.734000+00:00

A flaw was found in OpenPrinting CUPS. This authorization bypass vulnerability allows an unprivileged user to gain unauthorized access to restricted operations. This can be exploited by using a username that differs only in case from an authorized user during authorization checks.


Affected upstream versions: <= 2.4.16
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: 88516bf6d9e34cef7a64a704b856b837f70cd220
CVE-2026-27448: pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
Component: pyOpenSSL
Severity: Moderate
CWE: CWE-636 (Not Failing Securely ('Failing Open'))
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
Public date: 2026-03-17T23:24:30.661000+00:00

A flaw was found in pyOpenSSL. The set_tlsext_servername_callback callback function can be used to implement Server Name Indication (SNI) during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can allow an attacker to bypass SNI-based security controls and access restricted endpoints.

Statement: This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_tlsext_servername_callback function. For the handshake to proceed incorrectly, the callback must raise an unhandled exception, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with a moderate severity.

Affected upstream versions: >= 0.14.0, < 26.0.0
Fixed upstream versions: 26.0.0
Upstream repository: https://github.com/pyca/pyopenssl
Upstream fix commit: d41a814759a9fb49584ca8ab3f7295de49a85aa0
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devices
Component: util-linux
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-04-03T21:23:00.984000+00:00

A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the `mount` program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can substitute the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device that contains a valid filesystem, gaining full read access to its contents.

Statement: This vulnerability is only exploitable when an `/etc/fstab` entry exists with `user,loop` options and its source path points to a directory where the attacker has write permission (e.g., the user's home directory). Also, this issue allows an attacker to mount any root-owned file or block device containing a valid filesystem, causing information disclosure. There is no memory corruption or arbitrary code execution. Due to these reasons, this flaw has been rated with a moderate severity.

Affected upstream versions: < 2.41.4
Upstream repository: https://github.com/util-linux/util-linux
Upstream fix commit: 5e390467b26a3cf3fecc04e1a0d482dff3162fc4
CVE-2026-27459: pyOpenSSL: DTLS cookie callback buffer overflow
Component: pyOpenSSL
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-17T23:34:28.483000+00:00

A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.

Statement: This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: >= 22.0.0, < 26.0.0
Fixed upstream versions: 26.0.0
Upstream repository: https://github.com/pyca/pyopenssl
Upstream fix commit: 57f09bb4bb051d3bc2a1abd36e9525313d5cd408
CVE-2026-27489: onnx: ONNX: Information Disclosure via Path Traversal Vulnerability
Component: onnx
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2026-04-01T17:33:51.281000+00:00

A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. This path traversal vulnerability, exploitable via a symbolic link (symlink), allows an attacker to read arbitrary files located outside of the intended model or user-provided directories. This could lead to unauthorized information disclosure.

Statement: This Important flaw in Open Neural Network Exchange (ONNX) affects Red Hat OpenShift AI. An attacker could exploit a path traversal vulnerability through a crafted symbolic link within an ONNX model, leading to unauthorized disclosure of files outside the model's designated directories. This risk is present when processing untrusted ONNX models.

Affected upstream versions: < 1.21.0
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/onnx/onnx
Upstream fix commit: 4755f8053928dce18a61db8fec71b69c74f786cb
CVE-2026-27571: nats-server: WebSockets pre-auth memory DoS
Component: nats-server
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-24T15:59:17.926000+00:00

A flaw was found in nats-server. The WebSockets implementation fails to enforce a memory allocation limit during the decompression of WebSocket messages. A malicious compressed payload allows an attacker to cause an excessive memory consumption, eventually resulting in a server crash and a complete denial of service.

Statement: This flaw does not require valid NATS credentials to be exploited as the use of compression is negotiated before the authentication process. However, only deployments using WebSockets and that are exposed to untrusted network endpoints are vulnerable to this issue, limiting its exposure. Due to these reasons, this issue has been rated with a moderate severity.

Affected upstream versions: < 2.11.12, >= 2.12.0-RC.1, < 2.12.3
Fixed upstream versions: v2.14.0
Upstream repository: https://github.com/nats-io/nats-server
Upstream fix commit: f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017
CVE-2026-27601: Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions
Component: Underscore.js
Severity: Moderate
CWE: CWE-606 (Unchecked Input for Loop Condition)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-03T22:38:38.955000+00:00

A flaw was found in Underscore.js, a JavaScript utility library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) attack by providing specially crafted recursive data structures. When these structures are processed by the _.flatten or _.isEqual functions, which lack a depth limit for recursion, a stack overflow occurs. This can make the application unavailable to legitimate users.


Affected upstream versions: < 1.13.8
Fixed upstream versions: 1.13.8
Upstream repository: https://github.com/jashkenas/underscore
Upstream fix commit: 411e222eb0ca5d570cc4f6315c02c05b830ed2b4
CVE-2026-27606: rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability
Component: rollup
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-02-25T02:08:06.682000+00:00

A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.


Affected upstream versions: < 2.80.0, >= 3.0.0, < 3.30.0, >= 4.0.0, < 4.59.0
Fixed upstream versions: v4.59.0
Upstream repository: https://github.com/rollup/rollup
Upstream fix commit: c60770d7aaf750e512c1b2774989ea4596e660b2
CVE-2026-27830: c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects
Component: c3p0
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-26T00:45:18.222000+00:00

A flaw was found in c3p0, a Java Database Connectivity (JDBC) Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or `javax.naming.Reference` instances. By manipulating the `userOverridesAsString` property, an attacker can cause the application to download and execute malicious code from a remote location on its CLASSPATH.


Affected upstream versions: < 0.12.0
Fixed upstream versions: v0.12.0
Upstream repository: https://github.com/swaldman/c3p0
Upstream fix commit: e14cbd8166e423e2e9a9d6f08b2add3433492d6e
CVE-2026-27888: pypdf: pypdf: Denial of Service via crafted PDF
Component: pypdf
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-26T00:42:00.542000+00:00

A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected system. This issue specifically arises when the `xfa` property of a PDF reader or writer is accessed and its corresponding stream is compressed using `/FlateDecode`.


Affected upstream versions: < 6.7.3
Fixed upstream versions: 6.7.3
Upstream repository: https://github.com/py-pdf/pypdf
Upstream fix commit: 7a4c8246ed48d9d328fb596942271da47b6d109c
CVE-2026-27893: vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting
Component: vllm
Severity: Important
CWE: CWE-501 (Trust Boundary Violation)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-26T23:56:53.579000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user's explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.

Statement: This is an Important vulnerability in vLLM, as shipped in Red Hat AI Inference Server and Red Hat OpenShift AI. The flaw allows remote code execution due to vLLM hardcoding `trust_remote_code=True` when loading sub-components, which bypasses the user's explicit `--trust-remote-code=False` security opt-out. This can lead to exploitation through malicious model repositories.

Affected upstream versions: >= 0.10.1, < 0.18.0
Fixed upstream versions: v0.18.0
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: 00bd08edeee5dd4d4c13277c0114a464011acf72
CVE-2026-27942: fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
Component: fast-xml-parser
Severity: Moderate
CWE: CWE-776 (Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-26T01:22:11.383000+00:00

A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the `preserveOrder` option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service (DoS).

Statement: The flaw affects the XML builder component of the fast-xml-parser library and is triggered only when the preserveOrder option is explicitly enabled. In Red Hat–shipped configurations, this option is not enabled by default, and the vulnerable code path is therefore not exercised under typical deployments.
The underlying issue results in uncontrolled recursion leading to a stack overflow condition, which causes the application to terminate unexpectedly. While this can be triggered via crafted input, the impact is limited strictly to denial of service (DoS) and does not provide a mechanism for arbitrary code execution, privilege escalation, or data disclosure.
Furthermore, exploitation requires that the affected application processes attacker-controlled XML input through the XML builder functionality with the specific vulnerable configuration enabled. This significantly reduces the attack surface and introduces environmental constraints not considered in the generalized NVD scoring.

Given the absence of confidentiality and integrity impact, the requirement for non-default configuration, and the limitation of the impact to process termination, Red Hat considers the practical risk to be lower than the NVD assessment. As such, this issue is classified as Moderate severity.

Affected upstream versions: < 5.3.8
Fixed upstream versions: v5.3.8
Upstream repository: https://github.com/NaturalIntelligence/fast-xml-parser
Upstream fix commit: c13a961910f14986295dd28484eee830fa1a0e8a
CVE-2026-27951: freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
Component: freerdp
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-25T21:07:30.828000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. The `Stream_EnsureCapacity` function can create an endless blocking loop, leading to a Denial of Service (DoS). This vulnerability can be exploited on 32-bit systems where the available physical memory is greater than or equal to the `SIZE_MAX` variable, potentially affecting both client and server implementations using FreeRDP.


Affected upstream versions: < 3.23.0
Fixed upstream versions: 3.23.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 118afc0b954ba9d5632b7836ad24e454555ed113
CVE-2026-27959: koa: Koa: Host header injection vulnerability due to malformed HTTP Host header parsing
Component: koa
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Public date: 2026-02-26T01:45:45.668000+00:00

A flaw was found in Koa’s ctx.hostname API used in Node.js applications. The function incorrectly parses specially crafted HTTP Host headers containing an @ character, which can cause the extracted hostname value to differ from the intended origin. An attacker can exploit this behavior by sending a malicious Host header to influence the hostname value returned by ctx.hostname. Applications that rely on this value for generating absolute URLs, password reset links, or email verification links without additional validation may be susceptible to Host header injection attacks.

Statement: Red Hat Product Security considers this issue as High severity. 

A remote, unauthenticated attacker can send a specially crafted HTTP Host header containing a valid RFC 3986 userinfo component (using the @ delimiter). Due to improper parsing of the authority field in the ctx.hostname API, the application may treat attacker-controlled input as the hostname value. Exploitation occurs when the server processes the malicious request and does not require user interaction (UI:N).

Applications that rely on ctx.hostname to construct absolute URLs, such as: password reset links, email verification links, OAuth redirect URIs, or webhook endpoints, may generate security sensitive URLs that reference an attacker controlled domain. This can result in integrity violations, including manipulation of authentication flows or account takeover scenarios. Integrity impact is therefore rated High.

Confidentiality impact is considered Low because disclosure of sensitive data depends on application-specific usage patterns. The vulnerability does not automatically expose information from the server. However, if an affected application uses the manipulated hostname value to generate security-sensitive links such as password reset or email verification URLs and embeds tokens in those links without additional validation, a victim who later follows such a link may inadvertently disclose those tokens to an attacker controlled domain. Such disclosure is conditional, application-dependent like how the application constructs URLs. Also, the subsequent user interaction beyond the initial exploitation, the confidentiality impact is assessed as Low (C:L).

Affected upstream versions: >= 3.0.0, < 3.1.2, < 2.16.4
Fixed upstream versions: v3.1.2
Upstream repository: https://github.com/koajs/koa
Upstream fix commit: 55ab9bab044ead4e82c70a30a4f9dc0fc9c1b6df