huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-25506: MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery
Component: MUNGE
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L)
Public date: 2026-02-10T18:55:57.708000+00:00

A buffer overflow vulnerability was discovered in the MUNGE authentication daemon (munged). In affected versions, a local attacker can potentially leak secret cryptographic key material from the daemon's memory by sending a specially crafted message with an oversized address field. With the leaked key, an attacker could forge authentication credentials to impersonate any user, potentially escalating privileges in systems that rely on MUNGE for identity verification.

Statement: An Important vulnerability was discovered in `munged`. A local attacker could sending a specially crafted message to leak cryptographic key material. This could enable them to forge MUNGE credentials and impersonate any user, including a system administrator. The impact of this vulnerability is less than Critical as it cannot be exploited remotely.

Affected upstream versions: >= 0.5, < 0.5.18
Fixed upstream versions: munge-0.5.18
Upstream repository: https://github.com/dun/munge
Upstream fix commit: bf40cc27c4ce8451d4b062c9de0b67ec40894812
CVE-2026-25535: jsPDF: denial of service via malicious GIF dimensions
Component: jsPDF
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-19T14:34:05.648000+00:00

A flaw was found in jsPDF. The addImage and html methods accept user input in their first argument without proper sanitization. An attacker can supply a specially crafted GIF file, specifically with invalid width and height header values, forcing the application to allocate an excessive amount of memory, leading to an out-of-memory condition, causing an application crash and denial of service.

Statement: To exploit this flaw, an attacker must be able to process a specially crafted GIF file with an application using the addImage or html methods. This issue can cause the application to allocate an excessive amount of memory, eventually resulting in a denial of service with no other security impact. Due to this reason, this vulnerability has been rated with an important severity.

Affected upstream versions: < 4.2.0
Fixed upstream versions: v4.2.0
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: 2e5e156e284d92c7d134bce97e6418756941d5e6
CVE-2026-25646: libpng: LIBPNG has a heap buffer overflow in png_set_quantize
Component: libpng
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-02-10T17:04:38.501000+00:00

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.

Statement: For `java-17-openjdk-headless` and `java-21-openjdk-headless`, while the affected code is present in the bundled sources, it is not exercised by these headless packages.

Affected upstream versions: < 1.6.55
Fixed upstream versions: v1.6.55
Upstream repository: https://github.com/pnggroup/libpng
Upstream fix commit: 01d03b8453eb30ade759cd45c707e5a1c7277d88
CVE-2026-25749: vim: Vim: Arbitrary code execution via 'helpfile' option processing
Component: vim
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-02-06T22:43:38.630000+00:00

A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the 'helpfile' option. A local user could exploit this by providing a specially crafted 'helpfile' option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.

Statement: This MODERATE impact vulnerability in Vim's tag file resolution logic allows a local attacker to achieve a out-of-bounds write. By providing a specially crafted `helpfile` option value a local user can trigger a heap buffer overflow, as consequence lead to memory corruption presenting a data integrity impact or leading the vim process to crash resulting in availability impact. Although being non-trivial and very complex, arbitrary code execution is not discarded as worst case scenario.

Affected upstream versions: < 9.1.2132
Fixed upstream versions: v9.1.2132
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 0714b15940b245108e6e9d7aa2260dd849a26fa9
CVE-2026-25755: jsPDF: PDF object injection via unsanitized input in addJS method
Component: jsPDF
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-02-19T14:41:46.941000+00:00

A flaw was found in jsPDF. The addJS method accepts user input without proper sanitization, allowing an attacker to inject arbitrary PDF objects into the document. A specially crafted payload that escapes the JavaScript string delimiter can execute malicious actions or alter the document structure, resulting in arbitrary code execution when a user opens a PDF with a viewer that supports embedded scripts.

Statement: To exploit this flaw, an attacker must be able to supply a specially crafted payload to the application using the addJS method and convince a user to open the generated PDF document with a viewer that supports embedded scripts. Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: < 4.2.0
Fixed upstream versions: v4.2.0
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: 56b46d45b052346f5995b005a34af5dcdddd5437
CVE-2026-25896: fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
Component: fast-xml-parser
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Public date: 2026-02-20T20:57:48.074000+00:00

A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted XML input. The system incorrectly interprets a dot in a DOCTYPE entity name as a regular expression wildcard during processing. This allows the attacker to bypass security measures and inject malicious scripts, resulting in Cross-Site Scripting (XSS) when the parsed output is displayed to users.

Statement: This flaw has been assessed as IMPORTANT for Red Hat products. This vulnerability arises when the parsed XML output is subsequently rendered to users which requires the interaction of the user. The impact of this flaw is also limited to the user's browser context.

Affected upstream versions: >= 5.0.0, < 5.3.5, >= 4.1.3, < 4.5.4
Fixed upstream versions: v5.3.5
Upstream repository: https://github.com/NaturalIntelligence/fast-xml-parser
Upstream fix commit: 943ef0eb1b2d3284e72dd74f44a042ee9f07026e
CVE-2026-25940: jsPDF: PDF injection in AcroForm module allows arbitrary JavaScript execution (RadioButton children)
Component: jsPDF
Severity: Important
CWE: CWE-116 (Improper Encoding or Escaping of Output)
CVSS v3: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-02-19T15:26:57.645000+00:00

A flaw was found in jsPDF. The properties and methods of the Acroform module accept user input without sanitization, allowing an attacker to inject arbitrary PDF objects, such as JavaScript actions. Specifically, if an attacker can supply a specially crafted input to the AcroformChildClass.appearanceState property, JavaScript actions can be executed when a user opens the generated PDF document and hovers over the radio button.

Statement: To exploit this flaw, an attacker must be able to supply a specially crafted input to the AcroformChildClass.appearanceState property of the Acroform module and convince a user to open the generated PDF document, resulting in arbitrary JavaScript execution when the user interacts with radio buttons. Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: < 4.2.0
Fixed upstream versions: v4.2.0
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: 71ad2dbfa6c7c189ab42b855b782620fa8a38375
CVE-2026-25949: github.com/traefik/traefik: Traefik: Denial of Service via stalled STARTTLS requests
Component: github.com/traefik/traefik
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-12T20:01:19.600000+00:00

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. An unauthenticated client can exploit this vulnerability by sending a specific 8-byte Postgres SSLRequest (STARTTLS) prelude and then intentionally delaying further communication. This action bypasses Traefik's configured read timeouts, causing connections to remain open indefinitely. The primary consequence is a Denial of Service, as the server's resources become exhausted by these persistent, non-responsive connections.

Statement: This is an IMPORTANT denial of service flaw in Traefik, an HTTP reverse proxy and load balancer, affecting Red Hat OpenShift Dev Spaces. An unauthenticated client can exploit this by sending a specific STARTTLS request and then stalling, which bypasses configured read timeouts and causes connections to remain open indefinitely, leading to resource exhaustion.

Affected upstream versions: < 3.6.8
Fixed upstream versions: v3.6.8
Upstream repository: https://github.com/traefik/traefik
Upstream fix commit: 31e566e9f1d7888ccb6fbc18bfed427203c35678
CVE-2026-25952: freerdp: FreeRDP: Denial of service due to use-after-free vulnerability
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H)
Public date: 2026-02-25T20:24:07.396000+00:00

A flaw was found in FreeRDP. A remote attacker could exploit a use-after-free vulnerability in the `xf_SetWindowMinMaxInfo` function. This occurs when a freed window pointer is dereferenced because the main thread concurrently deletes a window while the Remote Desktop Protocol (RAIL) channel thread is still using the pointer. This flaw can lead to a denial of service.


Affected upstream versions: < 3.23.0
Fixed upstream versions: 3.23.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 1994e9844212a6dfe0ff12309fef520e888986b5
CVE-2026-25960: vLLM: vLLM: Server-Side Request Forgery bypass via inconsistent URL parsing
Component: vLLM
Severity: Important
CWE: CWE-474 (Use of Function with Inconsistent Implementations)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2026-03-09T21:01:01.827000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this Server-Side Request Forgery (SSRF) bypass vulnerability in the `load_from_url_async` method. The flaw occurs because the URL validation and the actual HTTP request handling use different parsing libraries, leading to inconsistencies. This allows an attacker to bypass existing SSRF protections, potentially leading to the disclosure of sensitive information from internal network resources.

Statement: This is an IMPORTANT vulnerability. The vLLM component, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, is affected by a Server-Side Request Forgery (SSRF) protection bypass. This flaw allows an attacker to circumvent existing SSRF safeguards due to inconsistent URL parsing between the validation layer and the underlying HTTP client when the `load_from_url_async` method is utilized.

Affected upstream versions: >= 0.15.1, < 0.17.0
Fixed upstream versions: v0.17.0
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: 6f3b2047abd4a748e3db4a68543f8221358002c0
CVE-2026-25990: pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
Component: pillow
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-02-11T20:53:52.524000+00:00

A flaw was found the Pillow Python imaging library. Providing a specially crafted PSD image  may lead to an out-of-bounds write. This could potentially allow for arbitrary code execution or information disclosure.


Affected upstream versions: >= 10.3.0, < 12.1.1
Fixed upstream versions: 12.1.1
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: 9000313cc5d4a31bdcdd6d7f0781101abab553aa
CVE-2026-25997: freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-02-25T20:38:40.483000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This vulnerability, a heap use-after-free, occurs during an auto-reconnect operation when the `xf_clipboard_formats_free` function frees memory that is still being accessed by another thread. A remote attacker could exploit this race condition, potentially leading to a denial of service by causing the application to crash.


Affected upstream versions: < 3.23.0
Fixed upstream versions: 3.23.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 58409406afe7c2a8a71ed2dc8e22075be4f41c0c
CVE-2026-26007: cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Component: cryptography
Severity: Important
CWE: CWE-354 (Improper Validation of Integrity Check Value)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-02-10T21:42:56.471000+00:00

A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.

Statement: This flaw, while difficult to exploit, would lead to a loss of integrity in the encrypted communication channel. Given that the cryptography package is a library, it is likely to be used in situations that do not require user interaction.

Affected upstream versions: < 46.0.5
Fixed upstream versions: 46.0.5
Upstream repository: https://github.com/pyca/cryptography
Upstream fix commit: 0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c
CVE-2026-2614: mlflow: mlflow: Arbitrary file read via bypassed source path validation
Component: mlflow
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-05-11T19:02:46.025000+00:00

A flaw was found in mlflow. An unauthenticated remote attacker can exploit a vulnerability in the `_create_model_version()` handler by including a specific tag, `mlflow.prompt.is_prompt`, in a `CreateModelVersion` request. This bypasses source path validation, allowing the attacker to specify an arbitrary local filesystem path as the model version source. Subsequently, the `get_model_version_artifact_handler()` function serves files from this unverified source, leading to the disclosure of arbitrary files from the server's filesystem and a complete confidentiality compromise.

Statement: This Important vulnerability in mlflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The flaw exists in the `_create_model_version()` handler, where a specially crafted request with the `mlflow.prompt.is_prompt` tag bypasses source path validation. This enables an attacker to specify an arbitrary local filesystem path, leading to complete confidentiality compromise within Red Hat OpenShift AI environments.

Affected upstream versions: unspecified < 3.10.0
Fixed upstream versions: 3.10.0
Upstream repository: https://github.com/mlflow/mlflow
Upstream fix commit: 6e801f4259d96804c73107315b24cef0f6aa115a
CVE-2026-26157: busybox: BusyBox: Arbitrary file overwrite and potential code execution via incomplete path sanitization
Component: busybox
Severity: Important
CWE: CWE-73 (External Control of File Name or Path)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-02-11T00:00:00+00:00

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.


Fixed upstream versions: 1.37.0-7.2.hum1
Upstream repository: https://git.busybox.net/busybox/commit/archival
Upstream fix commit: 3fb6b31c716669e12f75a2accd31bb7685b1a1cb
CVE-2026-26158: busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
Component: busybox
Severity: Important
CWE: CWE-73 (External Control of File Name or Path)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-02-11T00:00:00+00:00

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.


Fixed upstream versions: 1.37.0-7.2.hum1
Upstream repository: https://git.busybox.net/busybox/commit/archival
Upstream fix commit: 3fb6b31c716669e12f75a2accd31bb7685b1a1cb
CVE-2026-26209: cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads
Component: cbor2
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-23T18:53:10.268000+00:00

A flaw was found in cbor2, a library for encoding and decoding Concise Binary Object Representation (CBOR) data. A remote attacker can exploit this vulnerability by sending a specially crafted CBOR payload containing deeply nested structures. This can cause the application to crash due to uncontrolled recursion, leading to a complete Denial of Service (DoS) for the affected application.


Affected upstream versions: < 5.9.0
Fixed upstream versions: 5.9.0
Upstream repository: https://github.com/agronholm/cbor2
Upstream fix commit: e61a5f365ba610d5907a0ae1bc72769bba34294b
CVE-2026-26278: fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
Component: fast-xml-parser
Severity: Important
CWE: CWE-776 (Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-19T19:40:55.842000+00:00

A denial of service flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted, small XML input. This input can force the XML parser to perform an unlimited amount of entity expansion, consuming excessive resources. This can lead to the application freezing for an extended period, resulting in a Denial of Service (DoS).


Affected upstream versions: >= 5.0.0, < 5.3.6, >= 4.1.3, < 4.5.4
Fixed upstream versions: v5.3.6
Upstream repository: https://github.com/NaturalIntelligence/fast-xml-parser
Upstream fix commit: 910dae5be2de2955e968558fadf6e8f74f117a77
CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group
Component: openssl
Severity: Moderate
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2026-03-13T13:23:00.376000+00:00

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.

Statement: The impact of this flaw is limited to the choice of key agreement groups in a specific TLS connection. While a less a preferred key agreement group may allow for a connection to lack post-quantum protection, it is important to know that the connection will still be encrypted with a secure classical cipher and that the degradation of the cipher is limited to the active connection and is not a persistent degradation. Groups which the server operator has disallowed will not be used and it may be the case that the client and server fail to agree upon a key exchange group which would prevent the offending client from constructing a TLS connection.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6
Fixed upstream versions: 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f
CVE-2026-26955: freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline
Component: freerdp
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-02-25T20:47:14.660000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit a heap buffer overflow vulnerability by sending a specially crafted graphics command to a FreeRDP client. This allows the server to write data outside of its intended memory region, potentially leading to arbitrary code execution on the client system. The vulnerability occurs because the client does not properly validate the dimensions of incoming graphics commands.

Statement: A malicous RDP server may lead a heap buffer overflow in FreeRDP when the client is using the GDI surface pipeline. This happens when the server send a maliciously crafted RDPGFX ClearCodec command. When interpreting the command FreeRDP fails to validate the whether rectangle described by it falls within the destination surface dimension allowing the attacker to overwrite the surface data buffer without any boundaries check. Depending on the memory layout of the freerdp client's process it's possible to corrupt adjacent points leading to a remote code execution or force the freerdp client to crash.

Affected upstream versions: < 3.23.0
Fixed upstream versions: 3.23.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 7d8fdce2d0ef337cb86cb37fc0c436c905e04d77