Vulnerability intelligence

CVE-2024-6100 is a "Type Confusion" vulnerability found in the V8 JavaScript engine, which is a core component of Google Chrome. This flaw occurs when a program allocates or initializes a resource with one data type but then attempts to access it using an incompatible type. This discrepancy can lead to unexpected behavior within the software. Exploitation of CVE-2024-6100 can be achieved by a remote attacker who crafts a malicious HTML page. If a user running a vulnerable version of Google Chrome (specifically, versions prior to 126.0.6478.114) visits this specially designed page, the type confusion error in the V8 engine can be triggered. This allows the attacker to execute arbitrary code within the context of the browser.

CVE-2026-63077 is an unauthenticated remote code execution vulnerability affecting JetBrains TeamCity On-Premises versions prior to 2026.1.3 and 2025.11.7. This flaw, categorized as a deserialization of untrusted data (CWE-502), resides within the TeamCity agent polling protocol. An attacker with network access to the TeamCity server can exploit this vulnerability to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The root cause involves an issue with the XStream class type permission reset, which results in an overly permissive allowlist for deserialization.

CVE-2026-64561, dubbed "Zapscape," is a use-after-free vulnerability found in the Linux kernel's KVM virtualization code, specifically within the x86 shadow memory management unit (MMU). Discovered by researcher Hyunwoo Kim (@v4bel), the flaw stems from an incorrect ordering in page-fault handling. KVM checks the validity of the shadow MMU root before making MMU pages available; however, if shadow-page reclamation invalidates the in-use root during the subsequent page availability process, KVM can proceed to map memory using this now-stale root. This leads to the creation of invalid child shadow pages that are still added to the active MMU page list, violating KVM MMU invariants. Under specific conditions, such as when nested virtualization is enabled and an attacker has kernel-level control within a KVM guest, this vulnerability can be exploited to achieve a guest-to-host escape, allowing the attacker to execute code with root privileges on the host system. A public proof-of-concept exploit exists for Zapscape, which affects Linux kernels from version 5.9 onward.

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

CVE-2026-63077 is an unauthenticated remote code execution vulnerability affecting JetBrains TeamCity On-Premises versions prior to 2026.1.3 and 2025.11.7. This flaw, categorized as a deserialization of untrusted data (CWE-502), resides within the TeamCity agent polling protocol. An attacker with network access to the TeamCity server can exploit this vulnerability to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The root cause involves an issue with the XStream class type permission reset, which results in an overly permissive allowlist for deserialization.

CVE-2026-9198 is an unauthenticated remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. This flaw allows attackers to gain full control over default Langflow deployments by exploiting a chain of two API endpoints. Specifically, the vulnerability leverages the `/api/v1/auto_login` endpoint, which issues SUPERUSER tokens to any network caller without requiring authentication. Subsequently, attackers can utilize the `/api/v1/validate/code` endpoint to execute arbitrary Python code via `exec()`, leading to full remote code execution. This issue is classified under CWE-94, indicating improper control of code generation. The vulnerability has been addressed in Langflow version 1.10.1.