IT security 2026-09-27

Level Tense — 77/100 — 2026-09-27

Tense day: 11 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Citrix NetScaler Improper Input Validation Vulnerability (85/100).

  1. Citrix NetScaler Improper Input Validation Vulnerability — 85/100 (CVE-2026-88771)
  2. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — 85/100 (CVE-2026-88772)
  3. CVE-2026-88773 — Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetS… — 36/100 (CVE-2026-88773)
  4. CVE-2026-88775 — Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88775)
  5. CVE-2026-88776 — Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88776)
  6. CVE-2026-88777 — Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88777)
  7. CVE-2026-97163 — Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6… — 30/100 (CVE-2026-97163)
  8. CVE-2026-94130 — Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An S… — 28/100 (CVE-2026-94130)
  9. CVE-2026-100833 — Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect a… — 26/100 (CVE-2026-100833)
  10. CVE-2026-97162 — Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 — 25/100 (CVE-2026-97162)