Vulnerability intelligence

CVE-2026-19174 is an integer overflow vulnerability found within the V8 JavaScript engine of Google Chrome. This flaw, categorized as CWE-190, affects versions of Google Chrome prior to 151.0.7922.109. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code within the browser's context. This typically occurs if a user is enticed to interact with a specially crafted webpage.

CVE-2026-85046 is identified as a type confusion vulnerability residing within V8, the JavaScript and WebAssembly engine utilized by Google Chrome. This flaw enables a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The technical root cause of this vulnerability involves a bug in the V8 compilers, which leads to an array containing `PACKED_ELEMENTS` incorrectly receiving the map `PACKED_SMI_ELEMENTS`. This misclassification can be exploited to achieve arbitrary read and write capabilities on the JavaScript heap. The vulnerability was discovered and reported by security researcher Salvatore Gulizia (aka Serotav) on August 4, 2026, and affects Google Chrome versions prior to 152.0.7977.82. Google has released updates to address this issue, and has acknowledged that an exploit for CVE-2026-85046 exists in the wild.

CVE-2026-43502 describes a flaw identified within the Linux kernel, specifically affecting the Remote Direct Memory Access (RDMA) subsystem. The vulnerability arises during the handling of "zerocopy send" operations. When such a send operation fails prematurely, before the message has been successfully attached to the sending socket, the kernel may incorrectly manage the associated memory resources. This improper cleanup of memory can lead to issues with resource management within the system. The core of the problem lies in how the system determines zerocopy ownership during cleanup, particularly when a message has not yet been queued. This can potentially result in system instability or a denial of service.

CVE-2026-85046 is identified as a type confusion vulnerability residing within V8, the JavaScript and WebAssembly engine utilized by Google Chrome. This flaw enables a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The technical root cause of this vulnerability involves a bug in the V8 compilers, which leads to an array containing `PACKED_ELEMENTS` incorrectly receiving the map `PACKED_SMI_ELEMENTS`. This misclassification can be exploited to achieve arbitrary read and write capabilities on the JavaScript heap. The vulnerability was discovered and reported by security researcher Salvatore Gulizia (aka Serotav) on August 4, 2026, and affects Google Chrome versions prior to 152.0.7977.82. Google has released updates to address this issue, and has acknowledged that an exploit for CVE-2026-85046 exists in the wild.

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.