Vulnerability intelligence

CVE-2026-43499, publicly known as GhostLock, is a local privilege escalation vulnerability found within the Linux kernel. This flaw resides specifically in the `rtmutex` (real-time mutex) and Priority Inheritance (PI) futex requeue path. The core issue stems from an incorrect cleanup operation during a 'proxy-lock rollback' in the futex requeue process, where the system operates on the currently executing task instead of the true waiter task. This misdirection leaves behind stale priority-inheritance state and creates a use-after-free (UAF) condition, where the kernel attempts to use memory that has already been released. An attacker with local code execution can exploit this vulnerability to gain elevated privileges or execute unauthorized code on affected systems. The vulnerability was introduced in Linux 2.6.39 in May 2011 and affects kernels up to version 7.1.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2025-3248 is a code injection vulnerability that affects Langflow versions prior to 1.3.0. It exists in the `/api/v1/validate/code` endpoint, where a remote, unauthenticated attacker can send crafted HTTP requests to execute arbitrary code on the server. This vulnerability allows attackers to gain control of vulnerable Langflow servers without needing authentication. To remediate this vulnerability, users are advised to upgrade to Langflow version 1.3.0 or restrict network access to the application.

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.