Recently identified dangerous vulnerabilities that allow root access to the system or enable remote code execution:
- 20 vulnerabilities in Apache httpd, including a buffer overflow in mod_vhost_alias (CVE-2026-63292), potentially allowing remote code execution by sending an HTTP request with a large Host header. The vulnerability occurs when specifying a host name wildcard in the VirtualDocumentRoot directive and increasing the LimitRequestFieldSize limit.
Among other serious issues: use-after-free in mod_rewrite when using the %{LA-U:HTTP:…} construct (CVE-2026-56154); buffer overflow in mod_charset_lite (CVE-2026-56153); use-after-free in mod_http2 (CVE-2026-57941); buffer overflow when parsing file paths on Windows (CVE-2026-59685); integer overflow in mod_dav_fs (CVE-2026-93546). Issues have been fixed in release 2.4.69.
- 9 vulnerabilities in FreeBSD. Among the identified issues: buffer overflow leading to kernel-level code execution during manipulation of the semop system call (CVE-2026-58098); privilege escalation due to use-after-free in kqueue (CVE-2026-58099); path traversal beyond the root directory of an isolated jail environment (CVE-2026-101304, CVE-2026-101305, CVE-2026-101306); kernel crash by sending a specially crafted network packet when KTLS is enabled (CVE-2026-101302); bypassing network isolation mechanisms in jail (CVE-2026-101303). Vulnerabilities have been fixed in updates FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, and 14.4-RELEASE-p10.
- 6 vulnerabilities in LibreOffice, which upon opening specially crafted documents could lead to code execution (CVE-2026-63277, exploit), arbitrary file write (CVE-2026-63266), or leaking contents of local files (CVE-2026-63267, CVE-2026-63268, CVE-2026-63269). Issues have been fixed in LibreOffice 26.2.5 and 26.8.0.
- A vulnerability (CVE-2026-59265, exploit) in Apache OpenOffice leading to code execution when opening a specially crafted document due to a flaw in the Java integration functions. The issue will be addressed in release 4.1.17, which is currently undergoing candidate testing.
- Vulnerabilities in server CUPS vulnerabilities. Currently, only information about 14 issues with a threat level below 7 (CVSS) is disclosed, while a list of more severe problems will be published after the embargo expires, allowing time for fixes in the distributions. The most dangerous vulnerabilities disclosed allow privilege escalation (CVE not assigned) and remote code execution with lp user rights (CVE-2026-55453) when accessing an IPP printer controlled by an attacker. Issues have been fixed in CUPS version 2.4.20.
- A vulnerability (CVE-2026-80521, exploit) in the Linux kernel allows access to the host system from an isolated container. The vulnerability is caused by a race condition in the implementation of AF_UNIX sockets, leading to memory access after it has been freed, which can be exploited for arbitrary code execution at the kernel level. The issue has been fixed in the August kernel updates.
- For Debian GNU/Linux 13, a package update with Linux kernel 6.12.111-1 has been released, addressing 1313 vulnerabilities.
- A vulnerability (CVE-2026-94545) in the Next.js platform allows remote code execution on the server without authentication by sending a request to generate an SVG image, provided there is a handler for OG card (Open Graph) previews on the server. This issue is linked to a vulnerability in the Satori library, which is used for converting HTML and CSS to SVG. The vulnerability arises from lacking proper escaping checks before substituting escape characters in the SVG file, which could be exploited to add a <script> tag to the SVG markup, executing on the server when converting SVG to raster format. The issue has been fixed in Satori 0.33.5 and Next.js 15.5.26, 16.3.6, and 16.4.0.
- Vulnerabilities (CVE-2026-33937, CVE-2026-106445) in the JavaScript library handlebars.js, which has 50 million downloads weekly and 17 thousand dependent projects. The vulnerabilities allow for remote execution of JavaScript code on the server (when using the library with Node.js) through substituting already formed AST (Abstract Syntax Tree) objects into the template engine, in addition to string templates. The issues have been fixed in version 4.7.10.
- In the cryptographic library wolfSSL 5.9.4, 11 vulnerabilities have been fixed, the most dangerous of which allow authentication bypass through the use of fake certificates.
- 6 vulnerabilities in the Flatpak self-contained package system, including issues that allow files to be deleted (CVE-2026-97023) and written (CVE-2026-97024) in the main system with root privileges, as well as sending signals to processes outside of the isolated environment (CVE-2026-97029). These issues have been resolved in Flatpak version 1.18.4.
- A vulnerability in the PCRE2 library caused by a buffer overflow in the JIT compiler for regular expressions. An exploit has been prepared that allows for remote code execution in PHP projects, such as phpMyAdmin, when processing a specified regular expression provided by an attacker in PCRE2-based functions. This issue has been fixed in libpcre2 version 10.49.
- 14 vulnerabilities in the OpenSSL cryptographic library, the most dangerous of which can lead to leaking memory content during DTLS connection negotiation (CVE-2026-84782), accessing freed memory while concurrently accessing the same X.509 certificate from different threads (CVE-2026-84783), and recreating private keys through side-channel timing analysis during SM2 and brainpoolP384r1 signature generation (CVE-2026-54872, CVE-2026-77696). These issues have been resolved in OpenSSL versions 4.0.3, 3.6.5, 3.5.9, and 3.4.8.
- An exploit has been published for a vulnerability in the PostgreSQL database (CVE-2026-15742), allowing code execution on the server with the rights of the user under which the database is running, by sending specially formatted values to the SQL functions levenshtein() and levenshtein_less_equal(). This vulnerability has been fixed in PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24.
- The updates for the collaborative development platform Gitea 28.0.0 and 28.1.0 resolve several dozen vulnerabilities, including bypassing the change confirmation mechanism when sending a pull request (CVE-2026-104632), remote code execution in CI from a fork (CVE-2026-94205), and bypassing authentication in the built-in SSH server due to case insensitivity when querying the database (CVE-2026-103059).
- A buffer overflow (CVE-2026-102633) in the libexpat library occurs on 32-bit platforms when processing specially formatted XML files. This issue has been fixed in version 2.9.0.
- Two vulnerabilities in the FreeIPMI package for managing servers, which supports the IPMI (Intelligent Platform Management Interface). One of the vulnerabilities leads to a buffer overflow when processing specially formatted hostnames. These issues have been fixed in FreeIPMI version 1.6.20.
- As part of the Lightwell project, IBM and Red Hat identified and prepared fixes for over 400 vulnerabilities in open-source Java libraries.
Source: opennet.ru
