CVSS

A critical vulnerability, EUVD-2026-89143, has been disclosed in Google Chrome with a CVSS score of 9.6. The flaw involves non-heap memory handling in the browser's Fonts component and could allow a remote attacker, working alongside social engineering, to potentially compromise systems. The fix is included in Chrome 154.0.8037.57, published 29 September 2026 and updated the following day. Security watchers are flagging the severity rating and urging users to update their browsers promptly.

Security researchers have disclosed two vulnerabilities in CTranslate2, the machine learning inference engine used by Whisper and OpenNMT. CVE-2026-102566, rated CVSS 7.8, is a heap buffer overflow in the model loader that could allow arbitrary code execution, while CVE-2026-102567, rated 6.1, is an out-of-bounds read enabling memory disclosure or crashes. Developers running speech recognition or translation services are being urged to patch.

A critical vulnerability, CVE-2026-103041, has been disclosed affecting LightLLM through version 1.2.0. In multimodal deployments, the software exposes an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Security researchers warn attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code remotely. With a CVSS score of 9.3, admins running LightLLM are being urged to review exposed services and update as soon as possible.

A high-severity vulnerability, CVE-2026-103101 with a CVSS score of 8.6, affects Pexip Infinity versions 30.0 through 40.x before 41.0. The flaw stems from improper input validation in the web server component and could allow a malicious attacker to render a Pexip Infinity node inaccessible, disrupting video conferencing services. Administrators are being urged to update to version 41.0 or later to close the gap.

A new critical vulnerability, CVE-2026-70356 with a CVSS score of 9.4, has been disclosed affecting a TMS file upload endpoint. The flaw allows attackers to bypass server-side file type restrictions and upload malicious PHP files that can then be executed on the web server. Security researchers are sharing details of the bug, urging administrators to review and patch affected systems.

A critical vulnerability, tracked as CVE-2026-95281, has been disclosed in Google Chrome on Android. The buffer overflow in the ANGLE graphics library, carrying a CVSS score of 9.6, affected Chrome versions before 154.0.8037.57 and could let a remote attacker run arbitrary code outside the sandbox through a crafted HTML page. Security researchers are urging Android users to update Chrome immediately.

Microsoft's Visual Studio 2022 version 17.14, .NET 10.0 and .NET Framework 4.8 are affected by a vulnerability tracked as EUVD-2026-73170, rated 8.8 out of 10 on the CVSS v3.1 scale. The flaw is a heap-based buffer overflow in Visual Studio, and the advisory was published on 8 September 2026 with an update issued on 29 September 2026. Security trackers are flagging the high severity rating, urging developers using affected Microsoft products to check whether they need to update.

A security vulnerability, tracked as EUVD-2026-89477, has been identified in Naichen's ThinkCMF content management framework in versions up to 8.0.7. The flaw carries a CVSS v3.1 score of 5.1 out of 10, marking it as moderate severity. The advisory was updated on 29 September 2026, and multiple ThinkCMF product entries are listed as affected. Details of the vulnerable function remain limited in the published notice.

A high-severity vulnerability, EUVD-2024-55728, was published for Renovate, the popular open-source dependency update tool maintained by renovatebot. Versions 37.158.0 before 37.199.0 contain a command injection flaw in the helmv3 manager's registryAliases handling, rated 8.4 out of 10 on the CVSS v3.1 scale. Users are being urged to update to a patched release, as the bug could allow attackers to execute arbitrary commands through manipulated registry alias values.

Security firm Casco reports that every large language model it tested, including its own Jev model, inflated the severity of security findings when scoring vulnerabilities, overstating risk compared to expected CVSS ratings. The company published a benchmark detailing the results, prompting discussion about how far AI-generated severity scores can be trusted in security workflows.

A medium-severity vulnerability, tracked as EUVD-2026-62467 with a CVSS score of 6.8, was disclosed in Renovate, the dependency update tool maintained by renovatebot. Versions from 43.65.0 before 43.102.11 contain a remote code execution flaw affecting the bazel-module and bazelisk managers. The advisory was published on 19 August 2026 and updated on 29 September, and administrators are urged to upgrade to a fixed release.

A critical vulnerability, CVE-2026-102829 with a CVSS score of 9.2, has been disclosed in simple-git, the widely used Node.js package for running Git commands from JavaScript. The flaw stems from the argv-parser package, where versions before 2.0.1 omit VISUAL from the GitEnvKeys in parseEnv, affecting how prepareEnv handles the environment. Developers are being urged to check their dependencies and update.

A critical vulnerability, CVE-2026-95357, has been disclosed affecting Google Chrome on Android versions prior to 154.0.8037.57. The out-of-bounds write in the GPU component carries a CVSS score of 9.6 and could let a remote attacker execute arbitrary code outside the browser sandbox via a crafted HTML page. Security experts are urging users to update Chrome immediately.

Security researchers are flagging CVE-2026-95356, a critical use-after-free flaw in the WindowDialog component of Google Chrome. Versions prior to 154.0.8037.57 are affected. The bug carries a CVSS score of 9.6 and could let a remote attacker, using social engineering and a crafted HTML page, run arbitrary code outside the browser sandbox. Users are being urged to update Chrome promptly.

A critical vulnerability, CVE-2026-95350, has been disclosed in Google Chrome on Android. The buffer overflow in ANGLE, affecting versions before 154.0.8037.57, carries a CVSS score of 9.6 and could let a remote attacker execute arbitrary code outside the browser sandbox via a crafted HTML page. Chromium rates it Critical. Users are urged to update Chrome on Android to the latest version.

A critical vulnerability, CVE-2026-95349, has been disclosed in Google Chrome on Android. The buffer overflow in WebGL, rated CVSS 9.6, affects versions prior to 154.0.8037.57 and could let a remote attacker run arbitrary code outside the sandbox through a crafted HTML page. Chromium has classified the flaw as a critical security issue, and users are urged to update their browsers promptly.