Critical severity threats

A high-severity vulnerability in Google Chrome prior to version 157.0.8103.38 involves incorrect authorization in the FileSystem component. This flaw allows a remote attacker, using social engineering via a crafted HTML page, to potentially execute arbitrary code outside the browser sandbox. The vulnerability has a critical CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

A use-after-free vulnerability exists in the WebGPU component of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability is rated critical with a CVSS score of 9.6.

A buffer overflow vulnerability exists in the Skia component of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by delivering a specially crafted HTML page. The vulnerability has been assigned a critical severity rating with a CVSS score of 9.6.

A high-severity memory corruption vulnerability exists in the GPU component of Google Chrome on Android versions prior to 157.0.8103.38. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability is identified as CWE-119 and carries a critical CVSS score of 9.6.

A use-after-free vulnerability exists in the WebXR component of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

A use-after-free vulnerability exists in the mobile version of Google Chrome prior to 157.0.8103.38. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 9.6.

A use-after-free vulnerability in the Network component of Google Chrome prior to version 157.0.8103.38 could allow a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. The Chromium security team has rated the severity of this issue as low.

An incorrect authorization vulnerability in the FileSystem component of Google Chrome versions prior to 157.0.8103.38 allows a remote attacker to potentially execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and affects confidentiality, integrity, and availability.

An incorrect authorization vulnerability in the FileSystem component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to potentially execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The issue is rated with high severity and has a critical CVSS score of 9.6.

A use-after-free vulnerability exists in the Views component of Google Chrome on Windows versions prior to 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

A use-after-free vulnerability in the Prerender component of Google Chrome versions prior to 157.0.8103.38 allows a remote attacker to execute arbitrary code outside the sandbox by delivering a crafted HTML page. This vulnerability is rated critical due to its potential to compromise confidentiality, integrity, and availability.

An out-of-bounds write vulnerability exists in ANGLE within Google Chrome on Windows versions prior to 157.0.8103.38. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated critical with a high CVSS score of 9.6.

A vulnerability in the certificate-name matching logic of trapperkeeper-authorization, used by Puppet Server, allows clients with CA-signed certificates whose names extend or shorten an authorized hostname to be improperly authorized. This flaw enables impersonation of other nodes and, in Puppet Enterprise, unauthorized access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name issued by the certificate authority through approval or autosign.

A critical deserialization vulnerability exists in the report-processing code of Puppet Server. An attacker with any CA-signed agent certificate can submit a crafted report to execute arbitrary code on the Puppet Server as its service user. If the certificate authority autosigns requests without strong verification, an unauthenticated network attacker may obtain such a certificate and exploit this flaw.

A vulnerability in Google Chrome DevTools prior to version 157.0.8103.38 allows a remote attacker to execute arbitrary code outside the sandbox by leveraging social engineering with a crafted HTML page. The flaw is due to incorrect authorization in DevTools. The vulnerability has a high severity with a CVSS score of 9.6.

CVE-2026-95732 is an authentication bypass vulnerability in the underlying operating system of HPE Networking Fabric Composer. An unauthenticated attacker with adjacent network access could exploit this flaw to execute arbitrary code on the affected system. The vulnerability has a critical severity rating with a CVSS score of 9.6, indicating high impact on confidentiality, integrity, and availability.

Hardcoded password vulnerabilities exist in the command-line interface of HPE Networking Fabric Composer. These vulnerabilities could allow an unauthenticated remote attacker to access the system using hardcoded credentials. Successful exploitation would grant unauthorized administrative access with elevated privileges. The vulnerability has a critical severity with a CVSS score of 9.8.

A critical vulnerability in HPE Networking Fabric Composer allows an unauthenticated adjacent attacker to execute arbitrary code on the affected system. The flaw impacts confidentiality, integrity, and availability with a high severity score of 9.6. No affected versions or patch information are provided.

A vulnerability in Docker Desktop for Windows using the WSL2 backend allows an unprivileged Linux container to bypass seccomp restrictions on AF_VSOCK via 32-bit socketcall. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2 and is fixed in Docker Desktop 4.98.0 and WSL 3.0.3 or later. Older WSL versions remain vulnerable even with Docker Desktop 4.98.0.

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)