IT security 2026-09-28

Level Critical — 78/100 — 2026-09-28

Critical day: 15 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Citrix NetScaler Improper Input Validation Vulnerability (85/100).

1. Citrix NetScaler Improper Input Validation Vulnerability — 85/100 (CVE-2026-88771)
2. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — 85/100 (CVE-2026-88772)
3. CVE-2026-101072 — A vulnerability was identified in Netcore NR289-GE 1.4.5102. — 36/100 (CVE-2026-101072)
4. CVE-2026-101077 — A flaw has been found in Netcore NR289-GE 1.4.5102. — 36/100 (CVE-2026-101077)
5. CVE-2026-101110 — Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklib… — 36/100 (CVE-2026-101110)
6. CVE-2026-88773 — Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetS… — 36/100 (CVE-2026-88773)
7. pyjwt project pyjwt: PyJWT is a Python implementation of JSON Web Token standards. — 35/100 (CVE-2026-102266)
8. pyjwt project pyjwt: PyJWT is a Python implementation of JSON Web Token standards. — 35/100 (CVE-2026-102267)
9. CVE-2026-88775 — Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88775)
10. CVE-2026-88776 — Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88776)