Linuxsecurity Oracle Updates Fix XML Entity Use-After-Free Vulnerability
Article Content
- •CVE-2026-96889 is a high-severity use-after-free vulnerability in librsvg2.
- •Oracle has released critical patches for affected Oracle Linux versions 8 and 10.
- •Immediate patching is recommended to prevent potential server code execution.
Oracle has released updates for the librsvg2 library to address an use-after-free vulnerability (CVE-2026-96889) affecting multiple versions of Oracle Linux. The flaw allows for potential server code execution when XML includes have duplicated entities. This vulnerability has a CVSS score of 7.8, indicating a high severity level. Users of Oracle Linux 8 and 10 are urged to apply the patches immediately to mitigate risks. The vulnerability was publicly disclosed on September 23, 2026, with proof-of-concept code available since September 22. Administrators running self-managed GitLab installations are particularly at risk. The updates include various RPM packages for different architectures, including x86_64 and aarch64. Failure to patch could lead to significant security breaches.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-96889 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Oracle Linux are affected?
How severe is CVE-2026-96889?
What actions should I take?
Continue Reading
Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Actively Exploited Arista Networks has patched a critical SQL injection vulnerability, CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that allows authenticated users to escalate privileges to superuser status. The flaw, rated 9.9 on the CVSS scale, has been actively exploited in the wild, affecting on-premises deployments of VCO.… 
Next.js Releases Security Update for RCE Vulnerabilities On October 14, 2026, Vercel released an out-of-band security update for Next.js, addressing two unauthenticated remote code execution (RCE) vulnerabilities and a high-severity denial-of-service flaw. The update, available in versions 16.4.1 and 15.5.28, fixes issues with React Server Components and the librsvg library…