Vulnerability intelligence

CVE-2026-20274 is a vulnerability found in Cisco IOS XR Software, categorized under Common Weakness Enumeration (CWE) CWE-664, which pertains to improper control of a resource through its lifetime. This issue was identified during a comprehensive internal security review conducted by the Cisco IOS XR Software engineering team. The vulnerability allows a remote attacker to exploit the system by sending specially crafted input. Successful exploitation could lead to the execution of arbitrary code or cause a denial of service condition on the affected device.

CVE-2026-20279 identifies a set of improper access control vulnerabilities within Cisco IOS XR Software, categorized under Common Weakness Enumeration (CWE) CWE-284. These issues were discovered internally by Cisco's engineering team during a comprehensive security review. The vulnerabilities encompassed by CVE-2026-20279 include missing authentication for critical functions, improper certificate validation, and incorrect authorization. Exploitation of these flaws could allow a remote attacker to bypass existing authentication or authorization mechanisms, thereby gaining unauthorized access to critical functionalities or protected resources.

CVE-2026-12554 is a local privilege escalation vulnerability identified in HP Easy Start for macOS, affecting versions prior to 2.16.7.260722. This flaw allows a local attacker with low privileges to elevate their system privileges on the compromised macOS host. The vulnerability stems from the application's use of an outdated or risky component, categorized under CWE-1104. HP has released updated software to address and mitigate these potential security vulnerabilities.

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.