Vulnerability intelligence

CVE-2026-118306 is a memory corruption vulnerability residing in the FileSystem component of Google Chrome. The flaw affects Google Chrome versions prior to 156.0.8078.73. It is triggered when a user interacts with a specially crafted HTML page, allowing a remote attacker to exploit the underlying memory corruption. If successfully exploited, the vulnerability allows a remote attacker to potentially execute arbitrary code outside of the browser's sandbox environment. The exploit can be initiated over a network without requiring any special privileges, though it does depend on user interaction to be executed. Google has addressed this issue in the 156.0.8078.73 update.

CVE-2026-118344 is a use-after-free vulnerability identified in the Layout component of Google Chrome. Discovered and reported by security researcher Xinyang Ge, the flaw allows a remote attacker to execute arbitrary code within the browser's sandbox environment. This exploitation can be triggered when a user is induced to visit a specially crafted HTML page designed to target the vulnerability. The vulnerability affects Google Chrome versions prior to 156.0.8078.73. Google addressed the issue in a Stable channel update, releasing version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users are advised to update their browsers to the latest version to mitigate the risk of potential exploitation.

CVE-2026-118331 is a vulnerability affecting Google Chrome and other Chromium-based browsers, such as Microsoft Edge, prior to version 156.0.8078.73. The issue stems from improper input validation within the browser's FileAPI component. A remote attacker could exploit this flaw by convincing a user to visit a specially crafted HTML page, potentially allowing the attacker to execute arbitrary code within the browser's sandboxed environment. The vulnerability was discovered and reported by Anthropic researcher Xinyang Ge, who utilized the Claude AI model to assist in identifying the flaw. Google addressed the issue in late October 2026 with the release of Chrome version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users and administrators are advised to update their browsers to the latest version to mitigate the risk of exploitation.

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that affects versions 4.7 through 7.1.3. The issue arises during the core update process when WordPress extracts a full-package upgrade into a predictable, web-accessible staging directory within the `wp-content/upgrade` folder. Because these temporary paths are predictable, an unauthenticated remote attacker can target the staged installer files during the brief extraction window to execute arbitrary PHP code on the underlying server. The vulnerability, discovered by researcher Umut Bayram, was patched with the release of WordPress version 7.1.4 on October 28, 2026, with security fixes backported to all affected branches. Despite the narrow timing window required to successfully exploit the race condition, security firms observed automated scanning and exploitation attempts targeting the staged installer paths almost immediately after disclosure. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw stems from the system mishandling how the privileged `dsinvoked` broker trusts configuration data stored in the `DSCache`. By manipulating this trust—specifically by temporarily modifying library code in memory and altering a maintenance task in the configuration store—an attacker with local authenticated access can execute arbitrary code with root-level privileges. Discovered by cybersecurity firm Volexity, this vulnerability was actively exploited in the wild in October 2026 by a threat actor tracked as UTA0576. The attacker chained CVE-2026-111357 with an authentication bypass (CVE-2026-104935) and a predictable-filename weakness (CVE-2026-118527) to achieve unauthenticated root access on fully patched appliances, which they used to harvest Active Directory credentials and sensitive metadata. In response, Ivanti released security patches on October 29, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.