OpenRGB RCE, Tomcat bypasses, OpenSSL QUIC DoS

High-severity remote compromise bugs in OpenRGB led the day's oss-security traffic, alongside multiple Apache Tomcat access-control and DoS fixes, an OpenSSL QUIC advisory, an OpenStack Keystone scope flaw, and a Vim completion injection. The cluster of authentication and privilege issues will matter most to operators of RGB tooling, Java servlet containers, and cloud identity stacks.

OpenRGB remote compromise via custom network protocol

OpenRGB maintainers disclosed three high-severity flaws (CVE-2026-59682, CVE-2026-59683, CVE-2026-18794) in the project's root-privileged network server. A custom network protocol permits remote system compromise when the server is exposed. Anyone running OpenRGB with network features enabled should treat the disclosures as urgent because the process typically holds elevated privileges.

Apache Tomcat longest-prefix security constraint bypass

Apache Tomcat released a fix for CVE-2026-65182, an important issue that lets an attacker bypass longest-prefix security constraints through path ordering. The flaw weakens declarative access control. Deployments that rely on Tomcat security constraints need the update to restore intended enforcement.

Apache Tomcat RewriteValve [N] access-control bypass

Tomcat also disclosed CVE-2026-65927, an off-by-one error in the RewriteValve [N] flag that restarts processing at the second rule and can bypass access controls. The problem affects multiple supported branches. Sites using rewrite rules with the [N] flag should apply the available patches.

OpenSSL QUIC server double-free DoS

OpenSSL published a moderate-severity advisory dated 25 August 2026 covering a double-free in the QUIC server path that leads to denial of service. Services that terminate QUIC with OpenSSL are exposed. Operators should upgrade per the advisory to eliminate the crash path.

Apache Tomcat DataSourceRealm principal lookup fail-open

CVE-2026-68569 allows principal lookup to fail open under certain conditions, producing an authentication bypass for non-existent users in DataSourceRealm when CLIENT-CERT or SPNEGO is in use. The result is unintended access for invalid principals. Installations that combine that realm with those authenticators should patch promptly.

OpenStack Keystone delegated-token scope enforcement

OpenStack issued OSSA-2026-037 for Keystone, correcting inconsistent scope checks on delegated tokens (CVE pending). A delegated token could create persistent credentials or escape its project scope. Cloud operators that rely on token delegation need the fix to restore proper boundary enforcement.

Vim C omni-completion Ex command injection

Vim versions before 9.2.1011 permit arbitrary Ex command execution through ccomplete.vim when a pipe character appears in a tagfile name and is later fed to :execute during C omni-completion. The vector is limited to that completion path yet still yields local code execution. Users of the feature should move to 9.2.1011 or later.

Apache Tomcat HTTP/2 backlog allocation leak

CVE-2026-68763 describes a denial-of-service condition caused by an allocation leak in HTTP/2 backlog tracking when a stream is reset; the leak is fixed in 9.0.121 and later. Crafted resets can exhaust resources on HTTP/2-enabled instances. Upgrading closes the leak.