Vulnerability intelligence

CVE-2026-67276 is an SSH authentication bypass vulnerability affecting MikroTik RouterOS. The flaw stems from an incomplete verification process of RSA public keys during SSH authentication. Specifically, RouterOS checks the key type and modulus but fails to compare the entire RSA public key, omitting the exponent. This oversight allows an attacker, who possesses knowledge of a user's public modulus, to forge a different key and successfully log in via SSH without needing the corresponding private key. This vulnerability has been actively exploited as part of a larger attack chain dubbed "MikroTrick" and has been addressed in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

CVE-2026-85046 is identified as a type confusion vulnerability residing within V8, the JavaScript and WebAssembly engine utilized by Google Chrome. This flaw enables a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The technical root cause of this vulnerability involves a bug in the V8 compilers, which leads to an array containing `PACKED_ELEMENTS` incorrectly receiving the map `PACKED_SMI_ELEMENTS`. This misclassification can be exploited to achieve arbitrary read and write capabilities on the JavaScript heap. The vulnerability was discovered and reported by security researcher Salvatore Gulizia (aka Serotav) on August 4, 2026, and affects Google Chrome versions prior to 152.0.7977.82. Google has released updates to address this issue, and has acknowledged that an exploit for CVE-2026-85046 exists in the wild.

CVE-2026-19174 is an integer overflow vulnerability found within the V8 JavaScript engine of Google Chrome. This flaw, categorized as CWE-190, affects versions of Google Chrome prior to 151.0.7922.109. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code within the browser's context. This typically occurs if a user is enticed to interact with a specially crafted webpage.

CVE-2026-85046 is identified as a type confusion vulnerability residing within V8, the JavaScript and WebAssembly engine utilized by Google Chrome. This flaw enables a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The technical root cause of this vulnerability involves a bug in the V8 compilers, which leads to an array containing `PACKED_ELEMENTS` incorrectly receiving the map `PACKED_SMI_ELEMENTS`. This misclassification can be exploited to achieve arbitrary read and write capabilities on the JavaScript heap. The vulnerability was discovered and reported by security researcher Salvatore Gulizia (aka Serotav) on August 4, 2026, and affects Google Chrome versions prior to 152.0.7977.82. Google has released updates to address this issue, and has acknowledged that an exploit for CVE-2026-85046 exists in the wild.

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.