IT security 2026-10-01

Level Tense — 72/100 — 2026-10-01

Tense day: 10 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Fortinet FortiMail Path Traversal Vulnerability (86/100).

  1. Fortinet FortiMail Path Traversal Vulnerability — 86/100 (CVE-2026-104286)
  2. Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability — 68/100 (CVE-2026-76504)
  3. CVE-2026-102427 — Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - sit… — 31/100 (CVE-2026-102427)
  4. CVE-2026-76570 — Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1… — 31/100 (CVE-2026-76570)
  5. CVE-2026-100255 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via pass… — 30/100 (CVE-2026-100255)
  6. CVE-2026-100273 — In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code… — 30/100 (CVE-2026-100273)
  7. CVE-2026-100277 — In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature — 30/100 (CVE-2026-100277)
  8. Zammad GmbH Zammad Session Fixation Vulnerability — 29/100 (CVE-2026-102489)
  9. CVE-2026-103109 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media i… — 28/100 (CVE-2026-103109)
  10. CVE-2026-86131 — A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allow… — 28/100 (CVE-2026-86131)