Trending now

CVE-2024-6100 is a "Type Confusion" vulnerability found in the V8 JavaScript engine, which is a core component of Google Chrome. This flaw occurs when a program allocates or initializes a resource with one data type but then attempts to access it using an incompatible type. This discrepancy can lead to unexpected behavior within the software. Exploitation of CVE-2024-6100 can be achieved by a remote attacker who crafts a malicious HTML page. If a user running a vulnerable version of Google Chrome (specifically, versions prior to 126.0.6478.114) visits this specially designed page, the type confusion error in the V8 engine can be triggered. This allows the attacker to execute arbitrary code within the context of the browser.

CVE-2026-63077 is an unauthenticated remote code execution vulnerability affecting JetBrains TeamCity On-Premises versions prior to 2026.1.3 and 2025.11.7. This flaw, categorized as a deserialization of untrusted data (CWE-502), resides within the TeamCity agent polling protocol. An attacker with network access to the TeamCity server can exploit this vulnerability to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The root cause involves an issue with the XStream class type permission reset, which results in an overly permissive allowlist for deserialization.

CVE-2026-64561, dubbed "Zapscape," is a use-after-free vulnerability found in the Linux kernel's KVM virtualization code, specifically within the x86 shadow memory management unit (MMU). Discovered by researcher Hyunwoo Kim (@v4bel), the flaw stems from an incorrect ordering in page-fault handling. KVM checks the validity of the shadow MMU root before making MMU pages available; however, if shadow-page reclamation invalidates the in-use root during the subsequent page availability process, KVM can proceed to map memory using this now-stale root. This leads to the creation of invalid child shadow pages that are still added to the active MMU page list, violating KVM MMU invariants. Under specific conditions, such as when nested virtualization is enabled and an attacker has kernel-level control within a KVM guest, this vulnerability can be exploited to achieve a guest-to-host escape, allowing the attacker to execute code with root privileges on the host system. A public proof-of-concept exploit exists for Zapscape, which affects Linux kernels from version 5.9 onward.

CVE-2026-46316, also known as "ITScape," is a vulnerability found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 systems. Specifically, the flaw resides within the vgic-its (Virtual Generic Interrupt Controller – Interrupt Translation Service) component. This issue stems from a race condition that causes the translation cache's reference to an entry to be incorrectly dropped more than once during cache invalidation, leading to a "double-put" scenario and a use-after-free condition. This vulnerability allows a malicious guest virtual machine to escape its isolated environment and execute arbitrary commands on the host system with full kernel (root) privileges. Unlike typical virtualization escapes that target user-space components, ITScape exists entirely within the in-kernel KVM implementation, bypassing standard user-space protections. The exploit can be triggered through guest-side actions, such as crafted guest workloads performing specific GIC/ITS memory-mapped I/O operations, and a proof-of-concept exploit has been publicly released. Affected Linux kernel versions range from April 2024 to early June 2026.

CVE-2026-27912 is an improper authorization vulnerability found within Windows Kerberos. This flaw allows an authorized attacker to elevate their privileges when operating over an adjacent network. The vulnerability, classified under CWE-285 (Improper Authorization), stems from the Kerberos authentication protocol's failure to properly validate authorization controls. This enables attackers with initial network access to bypass authorization checks and gain elevated privileges within the affected Windows environment. This vulnerability is also referred to as "ResetNightmare".

CVE-2026-11331 describes a vulnerability within the BIND 9 software that affects its Response Policy Zone (RPZ) processing. An attacker can exploit this by crafting DNS query names that are excessively long. If a resolver uses RPZ with wildcard CNAME policies, these long query names can trigger a "NAMETOOLONG" error condition during processing. The vulnerability arises because this error condition is not handled correctly by the BIND 9 software. This improper handling can lead to two primary outcomes: either the RPZ rule is defeated, allowing the attacker to bypass intended security policies, or the BIND 9 software may terminate unexpectedly. This issue impacts various versions of BIND 9, including 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, and 9.21.0 through 9.21.23, as well as specific S1 releases.

CVE-2026-71320 describes a template injection vulnerability affecting Nuxt, an open-source web development framework for Vue.js. Specifically, versions of Nuxt from 3.4.0 up to, but not including, 3.21.10, and versions up to, but not including, 4.5.1 are impacted. An attacker can exploit this by injecting a template key through the `/__nuxt_island/` props into a dynamic component when `vue.runtimeCompiler: true` is enabled. This injection leads to template execution within the Nitro process, potentially allowing for server-side code execution. The issue has been addressed and fixed in Nuxt versions 3.21.10 and 4.5.1.

CVE-2026-33001 is a path traversal vulnerability affecting Jenkins versions 2.554 and earlier, as well as Jenkins LTS 2.541.2 and earlier. This flaw stems from Jenkins' inadequate handling of symbolic links during the extraction of `.tar` and `.tar.gz` archives. Attackers can exploit this by crafting malicious archives containing symbolic links that direct file writes to unintended locations on the filesystem. The vulnerability allows for arbitrary file writes, limited only by the file system permissions of the user running Jenkins. Exploitation requires an attacker to have "Item/Configure" permission or the ability to control agent processes. This can be leveraged to deploy malicious scripts or plugins onto the Jenkins controller, potentially leading to further compromise.

CVE-2026-64638 is a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability present in the login screen of all WordPress versions. This flaw allows for the execution of XSS without requiring attacker privileges or direct victim interaction once a specially crafted request is delivered. The vulnerability originates from how WordPress processes the username during a failed login attempt, specifically concerning the `sanitize_user()` and `wp_strip_all_tags()` functions, which can mishandle tag-like strings containing whitespace. Under specific circumstances, this XSS vulnerability can be escalated to achieve PHP code execution on the server. This escalation path is more involved, typically requiring a victim who is already logged in as a single-site Administrator to interact with an attacker-controlled page, alongside certain WordPress features and deployment conditions being met. WordPress addressed this issue in version 7.0.3, with fixes also backported to versions as far back as 4.7.

CVE-2026-18577 is an authentication bypass and account takeover vulnerability affecting N-able N-central versions through 2026.3.1. This flaw is a result of an incomplete patch for a previously identified vulnerability, CVE-2026-18556. Successful exploitation of CVE-2026-18577 allows remote attackers to gain administrative access to vulnerable N-central servers. Once administrative control is established, attackers can abuse the built-in "Take Control" feature to pivot into managed endpoints, deploy scripts, run tools, initiate remote-control sessions, and establish persistence within the compromised environment. The vulnerability impacts both hosted and on-premises deployments of N-able N-central.