Ansible Lightspeed RCEs, AWX/Systemd Flaws, Firefox Patches

Multiple vulnerabilities in the Ansible Lightspeed Visual Studio Code extension could allow for remote code execution and arbitrary code execution. Specifically, CVE-2026-44191, CVE-2026-44190, and CVE-2026-44189 detail command injection flaws in configuration settings and activation scripts, as well as arbitrary code execution via malicious playbook filenames. These issues pose a significant risk due to the potential for attackers to compromise systems through the extension. A separate vulnerability, CVE-2026-44192, in the Ansible Lightspeed MCP Server, allows for RCE and data exfiltration via path traversal. Additionally, CVE-2026-16566 highlights an information disclosure vulnerability in the community.general Jenkins credential module, which outputs API tokens in plaintext. CVE-2026-44187 specifically points to the disclosure of Google Gemini API keys.

A moderate severity vulnerability in AWX, CVE-2026-16544, allows for cross-organization stdout disclosure due to missing authorization checks in the websocket EventConsumer for inventory, project, and system job events. This could enable unauthorized access to sensitive operational data. Another moderate severity flaw, CVE-2026-16560, affects 389-ds-base, where a heap-buffer-overflow in rdn_av_swap can occur when processing quoted multivalued RDNs, potentially leading to denial-of-service or code execution.

The Systemd Project has a medium-risk vulnerability, CVE-2026-16552, where systemd-tmpfiles can be tricked into overwriting arbitrary files via a CHASE_SAFE root-to-unprivileged ownership transition bypass. This could allow an attacker to escalate privileges or disrupt system operations. In Eclipse GlassFish, CVE-2022-2712 allows unauthenticated remote attackers to access files via relative path traversal due to insufficient filtering of request paths starting with './'. This could lead to unauthorized information disclosure.

Mozilla has addressed a significant number of vulnerabilities in Firefox 153, including several low-severity issues. As Vypr Intelligence reported, these fixes cover mitigation bypasses in DOM and Networking components (CVE-2026-16394, CVE-2026-16406), information disclosure via uninitialized memory in Graphics: WebGPU (CVE-2026-16386), site isolation issues in Graphics (CVE-2026-16398), spoofing in the Address Bar (CVE-2026-16403), privilege escalations in DOM: Content Processes and Data Loss Prevention (CVE-2026-16372, CVE-2026-16401), sandbox escapes in DOM: Networking (CVE-2026-16388), and mitigation bypasses in DOM: Service Workers (CVE-2026-16407). Additionally, memory safety bugs, some with evidence of memory corruption, were fixed in Firefox 152 (CVE-2026-16411).