CVSS

Citrix has released fixes for two NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, both rated critical at CVSS 9.5 and both reportedly already exploited in the wild. Administrators are urged to update to NetScaler 14.1-73.37 or 13.1-64.23 and to check their systems for signs of compromise. Security teams worldwide are discussing the patch as urgent.

A cross-site scripting vulnerability, tracked as EUVD-2024-55777, has been disclosed in the Greek Universities Network (GUnet) Open eClass Platform version 3.15. The flaw, rated 5.4 out of 10 on the CVSS v3.1 scale, could let a remote attacker execute arbitrary code through user name fields. The advisory was published on 29 September and updated the following day.

A critical vulnerability, CVE-2026-103041, has been disclosed affecting LightLLM through version 1.2.0. In multimodal deployments, the software exposes an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Security researchers warn attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code remotely. With a CVSS score of 9.3, admins running LightLLM are being urged to review exposed services and update as soon as possible.

A high-severity flaw tracked as EUVD-2026-89423 affects Kilo Code versions before v7.4.1, scoring 8.4 out of 10 under CVSS v3.1. The issue, published on 29 September 2026 and updated a day later, allows a local attacker to execute arbitrary code through the permission or allow-everything endpoint. Users are urged to update to v7.4.1 or later.

Security researchers have disclosed two vulnerabilities in CTranslate2, the machine learning inference engine used by Whisper and OpenNMT. CVE-2026-102566, rated CVSS 7.8, is a heap buffer overflow in the model loader that could allow arbitrary code execution, while CVE-2026-102567, rated 6.1, is an out-of-bounds read enabling memory disclosure or crashes. Developers running speech recognition or translation services are being urged to patch.

A vulnerability tracked as EUVD-2026-89183 has been disclosed in CPython, the reference implementation of the Python language maintained by the Python Software Foundation. The flaw concerns cleanup of tempfile.TemporaryDirectory, where a race condition could let an attacker who can modify the directory tree during cleanup swap in a directory in place of the intended one. It is rated 5.9 out of 10 on the CVSS v3.1 scale, a moderate severity score.

A newly tracked vulnerability, EUVD-2026-89424, describes improper access control in the ArgusMonitor.sys driver used by Argotronic eGbR's hardware monitoring tool ArgusMonitor, affecting version 7.4.02 and earlier. With a CVSS v3.1 score of 5.3, the flaw reportedly allows local, low-privileged users to bypass device handle access restrictions. Published on 29 September and updated the next day, it is drawing attention from security watchers tracking Windows driver weaknesses.

A new vulnerability, EUVD-2026-70998, has been recorded for Fastify, the popular Node.js web framework. The flaw, rated 7.5 out of 10 on CVSS v3.1, allows a header validation bypass caused by incomplete schema case normalization. The entry in the European vulnerability database was updated on 30 September 2026. Security teams using Fastify are expected to review the advisory and check whether their deployments are affected.

A security advisory published as EUVD-2026-87707 describes a vulnerability in Capgo, the over-the-air update service for Capacitor apps, rated 8.6 out of 10 on the CVSS scale. Versions up to 12.261.0 reportedly contain an incomplete access-control fix for the public.sso_providers table, meaning earlier mitigation efforts did not fully close the flaw. The advisory was published on 26 September 2026 and updated on 30 September, prompting developers who rely on Capgo to check whether they need to update.

A new critical vulnerability, tracked as CVE-2026-75969 with a CVSS score of 9.1, has been disclosed affecting all PTZOptics cameras and the Firmware Upgrade Tool's Firmware Update modules. The flaw is a missing authentication issue in the firmware update mechanism, meaning critical functions could be triggered without proper credentials. Security watchers are flagging the severity and the breadth of affected devices.

A medium-high severity vulnerability, EUVD-2026-70989, has been catalogued in Fastify, the popular Node.js web framework. Rated 7.5 under CVSS v3.1, the flaw allows request validation bypass when boolean false schemas are skipped, potentially letting malformed requests through unchecked. The advisory was updated on 30 September 2026, and security teams using Fastify are being urged to review their validation logic and apply patches.

A new vulnerability, EUVD-2026-90275, has been recorded for Kiteworks' Email Protection Gateway, with a CVSS v3.1 score of 6.5 out of 10. The flaw concerns an authorization check in the large file exchange feature that failed to correctly verify whether the requesting user was entitled to access the resource. The entry was updated on 30 September 2026. Security teams monitoring Kiteworks deployments are expected to review the advisory and patch guidance.

A newly catalogued vulnerability, EUVD-2026-70988, affects the Fastify web framework, rated 7.5 out of 10 on the CVSS v3.1 scale. The flaw allows authentication bypass when malformed URLs reach encapsulated not-found handlers, meaning requests intended to be blocked could slip through route protections. Fastify is a widely used Node.js framework, so developers running exposed services are being urged to review the advisory and update to a patched version.

A critical vulnerability, CVE-2026-102458 with a CVSS score of 9.3, has been disclosed in EasyFlow .NET, enterprise software developed by Taiwanese vendor Digiwin. The flaw is a missing authentication issue: unauthenticated remote attackers can use a specific API to obtain other users' plaintext passwords. Security watchers are sharing details and urging affected organisations to review exposure and patch quickly.

Kiteworks Core versions before 9.5.0 are affected by a deserialization of untrusted data vulnerability, tracked as EUVD-2026-90276 with a CVSS v3.1 score of 8.1. Under certain conditions, the flaw could allow attackers to send crafted data that is deserialized unsafely, potentially leading to code execution. The advisory was updated on September 30, 2026, and users are advised to upgrade to version 9.5.0 or later.

A new security analysis reports 57 CVEs in the Vim text editor, with a maximum severity score of 9.2 and roughly 52% still unpatched. The most serious flaws are heap overflows and code injection bugs, and the report warns that third-party plugins expand the attack surface. Security practitioners are urging users to audit their Vim configurations and update promptly.

Microsoft's Visual Studio 2022 version 17.14, .NET 10.0 and .NET Framework 4.8 are affected by a vulnerability tracked as EUVD-2026-73170, rated 8.8 out of 10 on the CVSS v3.1 scale. The flaw is a heap-based buffer overflow in Visual Studio, and the advisory was published on 8 September 2026 with an update issued on 29 September 2026. Security trackers are flagging the high severity rating, urging developers using affected Microsoft products to check whether they need to update.

A critical vulnerability, EUVD-2026-89143, has been disclosed in Google Chrome with a CVSS score of 9.6. The flaw involves non-heap memory handling in the browser's Fonts component and could allow a remote attacker, working alongside social engineering, to potentially compromise systems. The fix is included in Chrome 154.0.8037.57, published 29 September 2026 and updated the following day. Security watchers are flagging the severity rating and urging users to update their browsers promptly.

A critical vulnerability, CVE-2026-73570 with a CVSS score of 8.9, in Zimbra Collaboration Suite allowed unauthenticated attackers to run operating system commands through its SNMP service. According to Microsoft Security Research, attackers exploited the flaw to deploy web shells and steal mailbox credentials. A patch has been released, and security teams are urged to update affected servers promptly.

A new vulnerability, tracked as EUVD-2026-89197, has been disclosed in IBM DataStage on Cloud Pak for Data 5.4.0.0. Rated 8.8 out of 10 on the CVSS v3.1 scale, the flaw could let a remote authenticated attacker execute arbitrary code because of improper path validation. Security teams monitoring IBM products are flagging the advisory as organisations assess whether their deployments are affected and await a fix.

A security vulnerability, tracked as EUVD-2026-89477, has been identified in Naichen's ThinkCMF content management framework in versions up to 8.0.7. The flaw carries a CVSS v3.1 score of 5.1 out of 10, marking it as moderate severity. The advisory was updated on 29 September 2026, and multiple ThinkCMF product entries are listed as affected. Details of the vulnerable function remain limited in the published notice.

A critical vulnerability, tracked as CVE-2026-102455 with a CVSS score of 9.3, has been reported in EasyFlow .NET, software developed by Taiwanese vendor Digiwin. According to the advisory, unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content, exploiting insecure deserialization. Organizations running the software are being urged to review the details and apply fixes promptly.

A security advisory, EUVD-2026-89198, flags an out-of-bounds read vulnerability in MobilityDB version 1.3.0 and earlier, located in the MEOS binary and library WKB deserialization logic. The flaw carries a CVSS v3.1 score of 7.1, marking it as high severity. The advisory was updated on 2026-09-29, and users of the open-source moving-object database extension are being urged to check for patched releases.

A high-severity vulnerability, EUVD-2024-55728, was published for Renovate, the popular open-source dependency update tool maintained by renovatebot. Versions 37.158.0 before 37.199.0 contain a command injection flaw in the helmv3 manager's registryAliases handling, rated 8.4 out of 10 on the CVSS v3.1 scale. Users are being urged to update to a patched release, as the bug could allow attackers to execute arbitrary commands through manipulated registry alias values.

Security researchers have flagged CVE-2026-96822, a critical vulnerability in the Books Gallery application, rated CVSS 9.3. The flaw is described as an unauthenticated SQL injection, meaning attackers need no credentials to exploit it remotely. Details and mitigation guidance are being circulated on security channels, with administrators urged to patch or isolate affected deployments quickly.

A new critical vulnerability, CVE-2026-70356 with a CVSS score of 9.4, has been disclosed affecting a TMS file upload endpoint. The flaw allows attackers to bypass server-side file type restrictions and upload malicious PHP files that can then be executed on the web server. Security researchers are sharing details of the bug, urging administrators to review and patch affected systems.

A medium-severity vulnerability, EUVD-2026-89199, has been catalogued in Eclipse Foundation's NetX Duo embedded network stack. Rated 6.0 out of 10 under CVSS v3.1, the flaw lies in the FTP component, where passive data connections are not bound to the authenticated control peer, potentially allowing session mixing. The entry was updated on 29 September 2026 via the EU vulnerability database maintained by ENISA.