Vulnerability intelligence

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2025-3699 is a vulnerability affecting Mitsubishi Electric air conditioning systems. It stems from a missing authentication process for critical functions within the affected systems. This vulnerability exists in multiple models, including G-50, AE-200 series, and EW-50 series, specifically impacting versions 3.37 and prior for G-series devices and older versions for AE/EW series devices. Successful exploitation of CVE-2025-3699 could allow an unauthenticated attacker to bypass authentication, illegally control the air conditioning systems, disclose sensitive system information, and potentially tamper with the device firmware. It is recommended to update the firmware to versions newer than 3.37 for G-series devices and 8.01 for AE/EW-series devices.

CVE-2025-1974 is a vulnerability within the Ingress NGINX Controller for Kubernetes, specifically affecting the admission controller component. This flaw falls under a group of vulnerabilities collectively known as "IngressNightmare." The vulnerability arises because the admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject arbitrary NGINX configurations. This results in code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, which could lead to a complete cluster takeover.

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that affects versions 4.7 through 7.1.3. The issue arises during the core update process when WordPress extracts a full-package upgrade into a predictable, web-accessible staging directory within the `wp-content/upgrade` folder. Because these temporary paths are predictable, an unauthenticated remote attacker can target the staged installer files during the brief extraction window to execute arbitrary PHP code on the underlying server. The vulnerability, discovered by researcher Umut Bayram, was patched with the release of WordPress version 7.1.4 on October 28, 2026, with security fixes backported to all affected branches. Despite the narrow timing window required to successfully exploit the race condition, security firms observed automated scanning and exploitation attempts targeting the staged installer paths almost immediately after disclosure. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw stems from the system mishandling how the privileged `dsinvoked` broker trusts configuration data stored in the `DSCache`. By manipulating this trust—specifically by temporarily modifying library code in memory and altering a maintenance task in the configuration store—an attacker with local authenticated access can execute arbitrary code with root-level privileges. Discovered by cybersecurity firm Volexity, this vulnerability was actively exploited in the wild in October 2026 by a threat actor tracked as UTA0576. The attacker chained CVE-2026-111357 with an authentication bypass (CVE-2026-104935) and a predictable-filename weakness (CVE-2026-118527) to achieve unauthenticated root access on fully patched appliances, which they used to harvest Active Directory credentials and sensitive metadata. In response, Ivanti released security patches on October 29, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.