A use-after-free in MongoDB Server's replication component can crash a replica set member, and two unauthenticated ping requests can set it up. Upgrade affected members to a fixed release, since authentication doesn't prevent it.
A race condition in Apache HTTP Server’s mod_http2 lets an unauthenticated remote attacker corrupt the heap and potentially take control of the server process. Versions 2.4.55 through 2.4.70 are affected when HTTP/2 is enabled, including servers already updated for CVE-2026-23918. Update to 2.4.71 or your distribution’s fixed package, or disable HTTP/2 until you can.
A race condition in the Linux kernel’s IPv4 TCP connection handling (CVE-2026-98432) lets a remote, unauthenticated attacker trigger a use-after-free on any exposed TCP service. A public proof of concept already reaches root code execution against MPTCP listeners. Here’s which kernels are affected, where fixes have shipped, and what to do until you can patch.
