Chrome Zero-Day Exploited; MikroTik, Tenda, WordPress Flaws Detailed

A critical type confusion vulnerability in Google Chrome's V8 JavaScript engine, identified as CVE-2026-85046, has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This flaw allows remote attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a specially crafted HTML page. Google has released an update, version 152.0.7977.82, to address this vulnerability, which is rated as High severity. The addition to the KEV catalog underscores the immediate threat this vulnerability poses to users and organizations. As reported by Help Net Security, this is the sixth Chrome zero-day to be actively exploited this year, highlighting a concerning trend in browser exploitation.

MikroTik has released patches for critical vulnerabilities affecting its RouterOS, including CVE-2026-86060 and CVE-2026-67277. CVE-2026-86060, a flaw in the SSH login process, allows attackers to change the trusted RouterOS policy mask, leading to privilege escalation. CVE-2026-67277 permits unauthenticated clients to initiate an IPv4 UDP test by exploiting a state where a "related" btest connection is accepted before the primary session authenticates. As detailed by GovInfoSecurity, these vulnerabilities have been actively exploited by attackers to hijack MikroTik devices without requiring authentication.

Multiple critical vulnerabilities have been disclosed in Tenda devices, primarily affecting the CP3 and HG10 models. CVE-2026-86152, CVE-2026-86167, CVE-2026-86151, and CVE-2026-86149 all involve OS command injection flaws in various components and functions, including Kylin and the Boa web server. Additionally, CVE-2026-86165 presents a buffer overflow vulnerability in the HG10 model's Boa web server. CVE-2026-86153 points to an improper privilege management issue in the CP3 model. These vulnerabilities carry high CVSS scores and present significant risks to users of these Tenda products.

Several WordPress plugins have been found to contain critical vulnerabilities, including SEO Flow by LupsOnline (CVE-2026-78362), SureCart (CVE-2026-18480), RegistrationMagic (CVE-2026-77826), and Music Store (CVE-2026-82304). The SEO Flow plugin allows unauthenticated users to be served as the administrator due to improper credential validation. SureCart and RegistrationMagic suffer from authorization bypasses that could allow users to modify other accounts or log in as existing users. The Music Store plugin is vulnerable to SQL injection exploitable by unauthenticated users due to a lack of input sanitization.

Critical vulnerabilities were identified in the libxml2 library, specifically CVE-2025-49796 and CVE-2025-49794. CVE-2025-49796 is a memory corruption issue triggered by processing specific sch:name elements in XML files, potentially leading to crashes. CVE-2025-49794 is a use-after-free vulnerability that occurs during XPath processing under certain schematron conditions. These flaws, detailed in CISA ICS Advisories, could allow attackers to craft malicious XML files to exploit these memory corruption issues.

Microsoft Entra ID has a critical missing authorization vulnerability (CVE-2026-83941) that could allow an authenticated attacker to elevate privileges over a network. Separately, PostgreSQL contains a vulnerability (CVE-2026-19633) that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries containing untrusted expressions.