IT security 2026-09-30

Level Tense — 74/100 — 2026-09-30

Tense day: 17 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (86/100).

  1. Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability — 86/100 (CVE-2026-76504)
  2. Apple Multiple Products Out-of-Bounds Write Vulnerability — 66/100 (CVE-2026-86950)
  3. CVE-2026-102427 — Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - sit… — 39/100 (CVE-2026-102427)
  4. CVE-2026-76570 — Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1… — 39/100 (CVE-2026-76570)
  5. CVE-2026-100255 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via pass… — 38/100 (CVE-2026-100255)
  6. CVE-2026-100273 — In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code… — 38/100 (CVE-2026-100273)
  7. CVE-2026-100277 — In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature — 38/100 (CVE-2026-100277)
  8. Zammad GmbH Zammad Session Fixation Vulnerability — 36/100 (CVE-2026-102489)
  9. electronjs electron: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. — 30/100 (CVE-2026-102676)
  10. simple-git project simple-git: simple-git, an interface for running git commands in any node.js application, enables applications to execute… — 30/100 (CVE-2026-102827)