IT security 2026-09-26

Level Critical — 78/100 — 2026-09-26

Critical day: 8 stories ranked, 3 of the top 8 reported as actively exploited, 3 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: WordPress Core Remote File Inclusion Vulnerability (75/100).

1. WordPress Core Remote File Inclusion Vulnerability — 75/100 (CVE-2026-87902)
2. Microsoft SharePoint Code Injection Vulnerability — 67/100 (CVE-2026-65660)
3. Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability — 61/100 (CVE-2026-67279)
4. CVE-2026-97163 — Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6… — 39/100 (CVE-2026-97163)
5. CVE-2026-94130 — Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An S… — 36/100 (CVE-2026-94130)
6. CVE-2026-97162 — Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 — 32/100 (CVE-2026-97162)
7. CVE-2026-97063 — X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GE… — 28/100 (CVE-2026-97063)
8. broadcom rabbitmq server: RabbitMQ is a messaging and streaming broker. — 24/100 (CVE-2026-67237)