CVSS

Citrix has released fixes for two NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, both rated critical at CVSS 9.5 and both reportedly already exploited in the wild. Administrators are urged to update to NetScaler 14.1-73.37 or 13.1-64.23 and to check their systems for signs of compromise. Security teams worldwide are discussing the patch as urgent.

A critical vulnerability, CVE-2026-103041, has been disclosed affecting LightLLM through version 1.2.0. In multimodal deployments, the software exposes an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Security researchers warn attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code remotely. With a CVSS score of 9.3, admins running LightLLM are being urged to review exposed services and update as soon as possible.

Security researchers have disclosed two vulnerabilities in CTranslate2, the machine learning inference engine used by Whisper and OpenNMT. CVE-2026-102566, rated CVSS 7.8, is a heap buffer overflow in the model loader that could allow arbitrary code execution, while CVE-2026-102567, rated 6.1, is an out-of-bounds read enabling memory disclosure or crashes. Developers running speech recognition or translation services are being urged to patch.

A vulnerability tracked as EUVD-2026-89183 has been disclosed in CPython, the reference implementation of the Python language maintained by the Python Software Foundation. The flaw concerns cleanup of tempfile.TemporaryDirectory, where a race condition could let an attacker who can modify the directory tree during cleanup swap in a directory in place of the intended one. It is rated 5.9 out of 10 on the CVSS v3.1 scale, a moderate severity score.

Microsoft's Visual Studio 2022 version 17.14, .NET 10.0 and .NET Framework 4.8 are affected by a vulnerability tracked as EUVD-2026-73170, rated 8.8 out of 10 on the CVSS v3.1 scale. The flaw is a heap-based buffer overflow in Visual Studio, and the advisory was published on 8 September 2026 with an update issued on 29 September 2026. Security trackers are flagging the high severity rating, urging developers using affected Microsoft products to check whether they need to update.

A security vulnerability, tracked as EUVD-2026-89477, has been identified in Naichen's ThinkCMF content management framework in versions up to 8.0.7. The flaw carries a CVSS v3.1 score of 5.1 out of 10, marking it as moderate severity. The advisory was updated on 29 September 2026, and multiple ThinkCMF product entries are listed as affected. Details of the vulnerable function remain limited in the published notice.

A high-severity vulnerability, CVE-2026-103101 with a CVSS score of 8.6, affects Pexip Infinity versions 30.0 through 40.x before 41.0. The flaw stems from improper input validation in the web server component and could allow a malicious attacker to render a Pexip Infinity node inaccessible, disrupting video conferencing services. Administrators are being urged to update to version 41.0 or later to close the gap.

A new critical vulnerability, CVE-2026-70356 with a CVSS score of 9.4, has been disclosed affecting a TMS file upload endpoint. The flaw allows attackers to bypass server-side file type restrictions and upload malicious PHP files that can then be executed on the web server. Security researchers are sharing details of the bug, urging administrators to review and patch affected systems.

A high-severity vulnerability, EUVD-2024-55728, was published for Renovate, the popular open-source dependency update tool maintained by renovatebot. Versions 37.158.0 before 37.199.0 contain a command injection flaw in the helmv3 manager's registryAliases handling, rated 8.4 out of 10 on the CVSS v3.1 scale. Users are being urged to update to a patched release, as the bug could allow attackers to execute arbitrary commands through manipulated registry alias values.

A new vulnerability, tracked as EUVD-2026-89197, has been disclosed in IBM DataStage on Cloud Pak for Data 5.4.0.0. Rated 8.8 out of 10 on the CVSS v3.1 scale, the flaw could let a remote authenticated attacker execute arbitrary code because of improper path validation. Security teams monitoring IBM products are flagging the advisory as organisations assess whether their deployments are affected and await a fix.

A critical vulnerability, tracked as CVE-2026-95281, has been disclosed in Google Chrome on Android. The buffer overflow in the ANGLE graphics library, carrying a CVSS score of 9.6, affected Chrome versions before 154.0.8037.57 and could let a remote attacker run arbitrary code outside the sandbox through a crafted HTML page. Security researchers are urging Android users to update Chrome immediately.

Security firm Casco reports that every large language model it tested, including its own Jev model, inflated the severity of security findings when scoring vulnerabilities, overstating risk compared to expected CVSS ratings. The company published a benchmark detailing the results, prompting discussion about how far AI-generated severity scores can be trusted in security workflows.

A security advisory, EUVD-2026-89198, flags an out-of-bounds read vulnerability in MobilityDB version 1.3.0 and earlier, located in the MEOS binary and library WKB deserialization logic. The flaw carries a CVSS v3.1 score of 7.1, marking it as high severity. The advisory was updated on 2026-09-29, and users of the open-source moving-object database extension are being urged to check for patched releases.

A medium-severity vulnerability, EUVD-2026-89199, has been catalogued in Eclipse Foundation's NetX Duo embedded network stack. Rated 6.0 out of 10 under CVSS v3.1, the flaw lies in the FTP component, where passive data connections are not bound to the authenticated control peer, potentially allowing session mixing. The entry was updated on 29 September 2026 via the EU vulnerability database maintained by ENISA.

A new security assessment of Netatalk, the open-source implementation of Apple's legacy AFP file-sharing protocol, counts 31 known CVEs with a maximum CVSS score of 9.9 and an average of 7.49. All vulnerabilities are reportedly patched, none appear in the CISA KEV catalogue, but tracking suggests around 20 more disclosures into 2026. The vendor's trust score is rated B.

A critical vulnerability, CVE-2026-102829 with a CVSS score of 9.2, has been disclosed in simple-git, the widely used Node.js package for running Git commands from JavaScript. The flaw stems from the argv-parser package, where versions before 2.0.1 omit VISUAL from the GitEnvKeys in parseEnv, affecting how prepareEnv handles the environment. Developers are being urged to check their dependencies and update.

A medium-severity vulnerability, tracked as EUVD-2026-62467 with a CVSS score of 6.8, was disclosed in Renovate, the dependency update tool maintained by renovatebot. Versions from 43.65.0 before 43.102.11 contain a remote code execution flaw affecting the bazel-module and bazelisk managers. The advisory was published on 19 August 2026 and updated on 29 September, and administrators are urged to upgrade to a fixed release.

A critical vulnerability, CVE-2026-95357, has been disclosed affecting Google Chrome on Android versions prior to 154.0.8037.57. The out-of-bounds write in the GPU component carries a CVSS score of 9.6 and could let a remote attacker execute arbitrary code outside the browser sandbox via a crafted HTML page. Security experts are urging users to update Chrome immediately.

Security researchers are flagging CVE-2026-95356, a critical use-after-free flaw in the WindowDialog component of Google Chrome. Versions prior to 154.0.8037.57 are affected. The bug carries a CVSS score of 9.6 and could let a remote attacker, using social engineering and a crafted HTML page, run arbitrary code outside the browser sandbox. Users are being urged to update Chrome promptly.

A critical vulnerability, CVE-2026-95350, has been disclosed in Google Chrome on Android. The buffer overflow in ANGLE, affecting versions before 154.0.8037.57, carries a CVSS score of 9.6 and could let a remote attacker execute arbitrary code outside the browser sandbox via a crafted HTML page. Chromium rates it Critical. Users are urged to update Chrome on Android to the latest version.

A critical vulnerability, CVE-2026-95349, has been disclosed in Google Chrome on Android. The buffer overflow in WebGL, rated CVSS 9.6, affects versions prior to 154.0.8037.57 and could let a remote attacker run arbitrary code outside the sandbox through a crafted HTML page. Chromium has classified the flaw as a critical security issue, and users are urged to update their browsers promptly.

A high-severity vulnerability, CVE-2026-92370 with a CVSS score of 8.8, has been disclosed in TeamViewer Full Client, Host and related modules on Windows, Linux and macOS. The improper access control flaw allows an authenticated remote attacker to bypass user-configured permission settings during remote sessions, potentially gaining unauthorized access to a user's system. Security teams are urged to review the advisory and apply fixes.

A new vulnerability, CVE-2026-42542 with a CVSS score of 7.5, has been disclosed in TDengine, an open-source time-series database used in OT and IoT deployments. The flaw is an integer underflow in pre-authentication RPC message parsing: a single crafted packet sent to TCP port 6030 can crash unauthenticated servers. Versions 3.4.0.0 through 3.4.1.5 are affected, with a fix released in version 3.4.1.6. No exploitation in the wild has been reported so far, and a proof-of-concept has been withheld.

A new vulnerability, CVE-2026-15890, has been disclosed in the Zephyr operating system's ITS AEAD transform. The static nonce counter is not synchronized, so concurrent writes can reuse an AES-GCM or ChaCha20-Poly1305 nonce, potentially compromising data integrity. The flaw carries a CVSS score of 5.3, and a patch is reportedly under review.

GitLab has released fixes for CVE-2026-84739, a high-severity vulnerability (CVSS 8.7) affecting all versions of GitLab CE/EE from 13.11 onwards. Under certain conditions, the flaw could have let an authenticated user execute arbitrary JavaScript in another user's browser. Patches are available in versions 19.2.7, 19.3.3 and 19.4.1, and self-hosted installations are urged to upgrade promptly.