IT security 2026-08-26

Level Critical — 99/100 — 2026-08-26

Critical day: 14 stories ranked, 7 of the top 10 reported as actively exploited, 7 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability (90/100).

1. Ajax.NET Professional Deserialization of Untrusted Data Vulnerability — 90/100 (CVE-2021-23758)
2. Gitea Code Injection Vulnerability — 86/100 (CVE-2026-60004)
3. Microsoft SQL Server Remote Code Execution Vulnerability — 85/100 (CVE-2019-1068)
4. Linux Kernel Out-of-Bounds Write Vulnerability — 68/100 (CVE-2022-0995)
5. Red Hat Libuser Race Condition Vulnerability — 68/100 (CVE-2015-3246)
6. Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability — 66/100 (CVE-2015-5287)
7. Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — 66/100 (CVE-2026-8452)
8. vmware spring cloud config: Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook reque… — 38/100 (CVE-2026-47837)
9. CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker co… — 30/100 (CVE-2026-65098)
10. CVE-2026-16286 — Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Softwa… — 29/100 (CVE-2026-16286)