CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-04-29 (4)

2026-04-29 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-04-29

4 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-42248 — 9.8 — Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns s…
  • CVE-2026-42249 — 9.8 — Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local …
  • CVE-2026-7333 — 9.6 — Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-42523 — 9.0 — Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site sc…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.