Cri-O RCE, DoS Flaws Lead July Security Updates

A critical vulnerability in the Linux container runtime cri-o, CVE-2026-15809, allows for arbitrary file reads and writes via the HOME environment variable, potentially leading to system compromise. This flaw, rated as high severity with a CVSS score of 7.8, poses a significant risk due to its potential impact on containerized environments. Users are advised to update cri-o to a patched version to mitigate this vulnerability.

Multiple denial-of-service vulnerabilities have been disclosed across various open-source projects. CVE-2026-50651 in Dotnet's SocketsHttpHandler could lead to an Out-of-Memory condition via an HTTP/2 SETTINGS/PING ACK flood. In the decompress library, CVE-2026-53486 allows arbitrary file read/write through crafted archive extractions. Rclone is affected by CVE-2026-59733, enabling unauthorized access to private repositories via directory traversal. Python's soupsieve package is vulnerable to denial-of-service attacks through crafted CSS selector strings in CVE-2026-49476 and CVE-2026-49477. Additionally, linkify-it, a markdown parsing library, suffers from a DoS vulnerability due to algorithmic complexity in CVE-2026-48801.

Several vulnerabilities have been patched in Mozilla Firefox and Google Chrome, including CVE-2026-15718 and CVE-2026-15719 for Firefox, and related flaws in Chrome. While exploit code is public for the Firefox vulnerabilities, no active exploitation in the wild has been reported. These issues were addressed in Firefox 152.0.6. The updates also address critical flaws in other software, as reported by The Hacker News and SecurityWeek.

Roundcube Webmail versions prior to 1.6.17 and 1.7.x before 1.7.2 contain several security issues. CVE-2026-62642 and CVE-2026-62641 describe denial-of-service vulnerabilities within the TNEF decoder, triggered by malformed attachments or crafted compressed-RTF sizes. Furthermore, CVE-2026-62644 allows for username spoofing via session data, potentially leading to account takeover. CVE-2026-62643 highlights insufficient CSS sanitization, which could result in Server-Side Request Forgery (SSRF) or information disclosure.

CVE-2023-30798, a vulnerability in the Starlette Python framework's MultipartParser, allows unauthenticated remote attackers to cause excessive memory usage, leading to a denial-of-service. This issue affects versions before 0.25.0. Separately, Netflix's Lemur, prior to version 1.3.2, used insufficiently random values for generating default credentials (CVE-2023-30797), potentially allowing attackers to guess credentials and gain unauthorized access.

SQLite versions prior to specific check-ins are affected by two vulnerabilities. CVE-2026-50812 involves a NULL pointer dereference in the Session Extension when processing a malformed changeset blob, leading to a denial of service. CVE-2026-50813, also within the Session Extension, allows local attackers to obtain sensitive information through a specific merge path in the changeset concatenation process.