57
30
30
55
57
Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server
Payara Server 7.2026.1.RC1 executes arbitrary OS commands when user-controlled Server-Side Includes #exec directives are passed to Runtime.exec without validation.
Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation that permits arbitrary operating system command execution via the #exec directive. User-controlled SSI directives are passed directly to Runtime.exec() without validation, sanitization, or restriction. An attacker who can cause the server to process an SSI file such as .shtml can execute arbitrary OS commands. The disclosed affected version is 7.2026.1.RC1.
35
30
30
55
57
USN-8563-5: nginx vulnerability
Ubuntu ships improved nginx fix for CVE-2026-42533 after earlier patch regression; flaw allows remote crash and possible code execution.
USN-8563-5 provides a better fix for CVE-2026-42533 after the original fix from USN-8563-1 was backed out in USN-8563-2 because it caused a regression. The flaw stems from nginx incorrectly handling certain map directives using regex matching and capture variables, allowing a remote attacker to crash nginx, causing denial of service, or possibly execute arbitrary code. The original advisory also described a use-after-free in the ngx_http_ssi_module when configured with Server-Side Includes, proxy_pass, and proxy buffering.
30
55
57
55
60
60
50
57
55
42