IT security 2026-10-08

Level Critical — 98/100 — 2026-10-08

Critical day: 28 stories ranked, 5 of the top 10 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: ProFTPD Improper Access Control Vulnerability (90/100).

  1. ProFTPD Improper Access Control Vulnerability — 90/100 (CVE-2015-3306)
  2. Apache Struts Command Injection Vulnerability — 85/100 (CVE-2016-3081)
  3. ISC BIND Data Processing Errors Vulnerability — 84/100 (CVE-2015-5477)
  4. ONLYOFFICE Docs Server Path Traversal Vulnerability — 75/100 (CVE-2021-3199)
  5. Strapi Cleartext Storage of Sensitive Information Vulnerability — 60/100 (CVE-2023-22894)
  6. CVE-2026-14888 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0… — 38/100 (CVE-2026-14888)
  7. CVE-2026-14988 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0… — 38/100 (CVE-2026-14988)
  8. CVE-2026-81932 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. — 38/100 (CVE-2026-81932)
  9. CVE-2026-82335 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB pr… — 38/100 (CVE-2026-82335)
  10. CVE-2026-82344 — IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap… — 38/100 (CVE-2026-82344)