A use-after-free vulnerability exists in the mod_auth_digest module of Apache HTTP Server versions before 2.4.69. This vulnerability allows an unauthenticated remote attacker to cause authentication state corruption via concurrent Digest authentication requests when specific configuration options are enabled. The issue is resolved in Apache HTTP Server version 2.4.69. The vulnerability has a CVSS score of 7.3, indicating a medium severity level.
CVE-2026-63686 is a NULL pointer dereference vulnerability in the mod_xml2enc module of Apache HTTP Server versions before 2.4.69. This flaw allows an untrusted backend server to cause a denial of service (DoS) by sending a proxied response with a charset whose conversion partially succeeds and then fails. The issue affects all platforms running these versions. Upgrading to version 2.4.69 or later resolves the vulnerability.
CVE-2026-59797 is a critical improper privilege management vulnerability in Apache HTTP Server's mod_ssl module affecting versions from 2.4.0 through 2.4.68. It involves incorrect handling of SSLRequire and file-related expressions, potentially allowing an attacker to bypass intended access restrictions. The vulnerability has a CVSS score of 9.8, indicating high severity. Ubuntu has released patches for affected versions across multiple LTS releases, and users are advised to update and restart Apache to apply fixes.
A Use After Free vulnerability (CWE-416) exists in the mod_http2 module of Apache HTTP Server versions 2.4.0 through 2.4.68. This flaw is caused by shared session->bbtmp re-entrancy, potentially leading to memory corruption. The vulnerability could allow a remote attacker to cause denial of service or execute arbitrary code. No exploits are currently known in the wild. Fixes are available and have been released in updated Apache packages for multiple Ubuntu LTS versions.
An integer overflow vulnerability exists in the mod_dav_fs module of Apache HTTP Server versions up to 2.4.68. This flaw allows an authenticated WebDAV client with write access to crash worker processes and cause persistent corruption of a directory's property database by sending PROPPATCH requests containing many XML namespaces. The vulnerability has a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. Fixes are available through official patches distributed by Ubuntu for affected versions.
CVE-2026-73636 is a high-severity authentication bypass vulnerability in the mod_auth_digest module of Apache HTTP Server 2.4.x. It allows an attacker to replay captured digest credentials to bypass authentication when the AuthDigestNonceLifetime is set to 0. This affects Apache HTTP Server versions from 2.4.0 up to but not including 2.4.69. Upgrading to version 2.4.69 mitigates the issue.
CVE-2026-79768 is a medium severity vulnerability in Apache HTTP Server's mod_userdir module affecting versions 2.4.0 through 2.4.68. It involves a path equivalence issue with the '/./' (single dot directory) sequence when the UserDir directive is configured with an absolute non-wildcard path. This flaw could allow information disclosure due to improper path handling.
CVE-2026-58415 is a vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.68 where internal state files related to WebDAV dead properties are accessible to remote clients. This occurs due to mod_dav_fs allowing GET requests to the .DAV state directory, exposing information about resources the client cannot author. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-56153 is a high-severity out-of-bounds write vulnerability in the mod_charset_lite module of Apache HTTP Server versions 2.4.0 through 2.4.68. This vulnerability could lead to memory corruption and potentially impact confidentiality. There are no known exploits reported in the wild at this time.
CVE-2026-48005 is a high-severity vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.68. It involves missing authentication checks in the mod_auth_digest module when Digest authentication is enabled with the AuthDigestNcCheck option. This flaw allows unauthenticated remote attackers to cause a denial of service by forcing re-authentication via forged Authorization headers. The issue is fixed in version 2.4.69.
Osavul, a hybrid risk intelligence company, has raised $10 million in Series A funding to enhance its AI platform that detects hostile intent across cyber, physical, and information domains. The platform analyzes open and privileged data to identify threats before attacks occur, supporting government, defense, and security institutions in over 10 countries. Osavul's technology was initially developed during Russia's invasion of Ukraine and is part of NATO's Information Environment Assessment Capability. The company aims to expand its capabilities into enterprises and critical infrastructure sectors amid increasing hybrid threats combining cyberattacks, sabotage, espionage, and information manipulation.
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.
HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.
This analysis discusses the limitations of relying solely on vulnerability scanners for effective vulnerability management. Despite the increasing number of detected critical vulnerabilities and faster exploitation attempts aided by AI, many organizations experience delays in identifying, prioritizing, and remediating vulnerabilities. These delays create windows of opportunity for attackers to exploit known flaws. The article emphasizes that vulnerability scanners only detect issues but do not ensure timely or complete remediation. It outlines key processes for effective vulnerability management, including asset inventory, prioritization based on contextual risk, secure configuration management, and verification of patch deployment. The discussion also introduces Kaspersky's Vulnerability Management module designed to address these challenges by automating inventory, scanning, configuration checks, and prioritization.
CVE-2026-73975 is a high-severity vulnerability in the 4TUResearchData djehuty research data repository system. Before version 26.3.2, authenticated depositors can inject arbitrary SPARQL commands into state-modifying queries by manipulating the session name. This allows them to write or delete arbitrary triples anywhere in the shared RDF store, compromising the integrity of the entire repository metadata. The vulnerability requires a logged-in account, but self-registration via ORCID or SAML lowers the barrier to exploitation. The issue has been fixed in version 26.3.2.
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
A critical vulnerability (CVE-2026-96658) in Foreman allows an authenticated attacker with low-level permissions to bypass the safemode sandbox in the templating engine, enabling remote code execution on the hosting server. This occurs due to improper handling of delegated methods, allowing unauthorized functions to be appended to the allowed execution list. The flaw affects Foreman versions 6.19.0 through 6.19.4. A security update is available in Red Hat Satellite 6.19.5 that addresses this issue.
CVE-2026-101890 is a stored cross-site scripting (XSS) vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows attackers to inject arbitrary JavaScript code via an unescaped site_title value in a package's footprint.json file. The malicious script executes in an administrator's browser when viewing the Prime Mover Packages list, without requiring package restoration.
CVE-2026-101889 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to delete arbitrary directories by importing a crafted package with manipulated configuration values. This can lead to deletion of critical WordPress directories such as wp-admin, potentially rendering the site inoperable.
CVE-2026-101888 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to write arbitrary files outside the intended extraction directory during ZIP import. This can lead to remote code execution if malicious files are processed by the web environment.