Vulnerability intelligence

CVE-2024-6100 is a "Type Confusion" vulnerability found in the V8 JavaScript engine, which is a core component of Google Chrome. This flaw occurs when a program allocates or initializes a resource with one data type but then attempts to access it using an incompatible type. This discrepancy can lead to unexpected behavior within the software. Exploitation of CVE-2024-6100 can be achieved by a remote attacker who crafts a malicious HTML page. If a user running a vulnerable version of Google Chrome (specifically, versions prior to 126.0.6478.114) visits this specially designed page, the type confusion error in the V8 engine can be triggered. This allows the attacker to execute arbitrary code within the context of the browser.

CVE-2026-64638 is a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability present in the login screen of all WordPress versions. This flaw allows for the execution of XSS without requiring attacker privileges or direct victim interaction once a specially crafted request is delivered. The vulnerability originates from how WordPress processes the username during a failed login attempt, specifically concerning the `sanitize_user()` and `wp_strip_all_tags()` functions, which can mishandle tag-like strings containing whitespace. Under specific circumstances, this XSS vulnerability can be escalated to achieve PHP code execution on the server. This escalation path is more involved, typically requiring a victim who is already logged in as a single-site Administrator to interact with an attacker-controlled page, alongside certain WordPress features and deployment conditions being met. WordPress addressed this issue in version 7.0.3, with fixes also backported to versions as far back as 4.7.

CVE-2026-27912 is an improper authorization vulnerability found within Windows Kerberos. This flaw allows an authorized attacker to elevate their privileges when operating over an adjacent network. The vulnerability, classified under CWE-285 (Improper Authorization), stems from the Kerberos authentication protocol's failure to properly validate authorization controls. This enables attackers with initial network access to bypass authorization checks and gain elevated privileges within the affected Windows environment. This vulnerability is also referred to as "ResetNightmare".

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

CVE-2026-63077 is an unauthenticated remote code execution vulnerability affecting JetBrains TeamCity On-Premises versions prior to 2026.1.3 and 2025.11.7. This flaw, categorized as a deserialization of untrusted data (CWE-502), resides within the TeamCity agent polling protocol. An attacker with network access to the TeamCity server can exploit this vulnerability to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The root cause involves an issue with the XStream class type permission reset, which results in an overly permissive allowlist for deserialization.

CVE-2026-9198 is an unauthenticated remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. This flaw allows attackers to gain full control over default Langflow deployments by exploiting a chain of two API endpoints. Specifically, the vulnerability leverages the `/api/v1/auto_login` endpoint, which issues SUPERUSER tokens to any network caller without requiring authentication. Subsequently, attackers can utilize the `/api/v1/validate/code` endpoint to execute arbitrary Python code via `exec()`, leading to full remote code execution. This issue is classified under CWE-94, indicating improper control of code generation. The vulnerability has been addressed in Langflow version 1.10.1.