medium1 source
The CVSS version 4.0 framework introduced by the Forum of Incident Response and Security Teams is shifting how vulnerability severity gets measured across the industry. Under this standard, vendors assign a base severity score representing the technical ceiling of a flaw, which is subsequently adjusted using dynamic threat metrics like exploit maturity.
When a vulnerability has no known active exploitation or public proof-of-concept, the calculated threat-adjusted score drops significantly below the base technical score. Security leaders note that this design aims to give vulnerability management teams a standardized method to de-prioritize bugs that currently lack weaponized tooling.
However, researcher Kevin Beaumont highlighted that vendors serving as CVE Numbering Authorities, including major players like Cisco, Microsoft, and Palo Alto Networks, can define consumer-oriented threat metrics during initial disclosure. By tagging exploit maturity as 'Unreported' rather than leaving it 'Not Defined'—which historically assumed worst-case conditions—vendors can effectively prevent critical unauthenticated remote code execution bugs from scoring above an 8.0.
This structural shift risks misclassifying critical flaws as mere high-severity items on disclosure day, creating blind spots for operational patching workflows. Practitioners warn that vendors rarely return to update these CVSS threat vectors once weaponized exploits surface publicly, leaving downstream organizations with deflated scores unless internal teams continuously re-evaluate external intelligence against their assets.
Read more → about CVSS v4.0 Exploit Maturity Metrics Are Leading to Artificially Deflated Vulnerability Scoreshigh2 sourcesCVE-2026-84323 CVE-2026-84324 +24
Google has rolled out an update for Chrome's desktop Stable Channel addressing 26 security vulnerabilities across the browser ecosystem.
The update bumps Chrome to version 152.0.7977.75/.76 for Windows and macOS, alongside versions 152.0.7977.75 or 152.0.7977.76 on Linux.
Leading the release are two critical memory safety defects, tracked as `CVE-2026-84353` and `CVE-2026-84352`.
`CVE-2026-84353` represents a critical use-after-free bug in the Shared Tab Groups component, while `CVE-2026-84352` is a use-after-free flaw inside Chrome’s WebGL graphics rendering pipeline.
In addition to the critical items, the release resolves nine high-severity vulnerabilities affecting subsystems like `V8`, `Skia`, `Omnibox`, `FileSystem`, and the GPU process.
These high-severity flaws include an uninitialized resource condition in `V8` (`CVE-2026-84326`), a GPU buffer overflow (`CVE-2026-84351`), and an incorrect authorization bug in `FileSystem` (`CVE-2026-84354`).
The update also mitigates fifteen medium and low-severity defects spanning components like WebRTC, TabStrip, Navigation, and FullScreen UI handling.
Google indicated that public bug details remain restricted until a majority of active desktop clients apply the fixes.
Furthermore, neither Google nor tracking sources noted any evidence of active exploitation in the wild for these specific CVEs prior to patch deployment.
Read more → about Google ships patches for 26 Chrome security flaws including critical memory bugs in WebGL and Shared Tab Groupscritical1 sourceCVE-2026-77537 CVE-2026-77545 +3
Ubiquiti released a major security advisory addressing 22 vulnerabilities across nearly its entire product stack. The impacted software includes UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, and the core UniFi OS platform. Out of the 22 addressed flaws, 21 carry a critical severity rating, with three vulnerabilities scoring a maximum CVSS rating of 10.0. Specifically, CVE-2026-77537 enables unauthenticated network attackers to execute arbitrary commands on the UniFi Protect host due to poor input validation. A related unauthenticated command injection bug, tracked as CVE-2026-77554, affects the UniFi Talk application. For the underlying operating platform, CVE-2026-77550 allows attackers to bypass authentication on UniFi OS instances via improper neutralization of CRLF sequences. Another notable vulnerability, CVE-2026-77545, carries a 9.0 CVSS score and stems from leftover active debugging code in UniFi OS. Additionally, CVE-2026-77549 presents another authentication bypass condition linked to CRLF handling. Ubiquiti indicated that these bugs are easily exploitable across local or remote networks without user interaction, though active in-the-wild exploitation was not confirmed prior to patch publication. Fixed software releases have been deployed across all affected product lines, requiring administrators to update to versions such as UniFi Network Application 10.5.67 and UniFi OS Server 5.1.37.
Read more → about Ubiquiti Patches 22 Vulnerabilities Across UniFi Ecosystem, Including Three Max-Severity Flaws