Daily digest
Sunday 27 September 2026
A quiet day: only 161 new CVEs against a recent average of about 377. Of those, 24 critical and 52 high. 73 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. AzuraCast was the most-affected vendor with 11.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-88771Critical· 9.8CISA KEV0dayPoCImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…
CVE-2026-88772High· 8.1CISA KEV0dayPoCVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…
New this day, ranked by depth score
The 12 that matter most of the 161 published.
CVE-2026-88771Critical· 9.8CISA KEV0dayPoCImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…
CVE-2026-88772High· 8.1CISA KEV0dayPoCVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…
MAL-2026-17200Critical⚠ ExploitedMalicious code in aseity (PyPI)
Malicious code in aseity (PyPI)
MAL-2026-17199Critical⚠ ExploitedMalicious code in scrapetools2 (PyPI)
Malicious code in scrapetools2 (PyPI)
MAL-2026-17198Critical⚠ ExploitedMalicious code in caracas4check (PyPI)
Malicious code in caracas4check (PyPI)
MAL-2026-17197Critical⚠ ExploitedMalicious code in coinscan (PyPI)
Malicious code in coinscan (PyPI)
MAL-2026-17196Critical⚠ ExploitedMalicious code in donutpromotion (PyPI)
Malicious code in donutpromotion (PyPI)
MAL-2026-17195Critical⚠ ExploitedMalicious code in claudedashbord (PyPI)
Malicious code in claudedashbord (PyPI)
MAL-2026-17194Critical⚠ ExploitedMalicious code in metrics-sdk (PyPI)
Malicious code in metrics-sdk (PyPI)
MAL-2026-17193Critical⚠ ExploitedMalicious code in metrio (PyPI)
Malicious code in metrio (PyPI)
MAL-2026-17192Critical⚠ ExploitedMalicious code in donutautosellsrc (PyPI)
Malicious code in donutautosellsrc (PyPI)
CVE-2026-88773Critical· 10.0PoCInconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, a…
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, a…
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL pathsseverity, cvss37
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available57
- CVE-2026-88771Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…exploited, exploit_available95
- CVE-2026-88772Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…exploited, exploit_available85
- CVE-2026-96280The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, …severity, cvss41
- CVE-2026-96276If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working …severity, cvss36
- CVE-2026-96279A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contentsseverity, cvss36
Most-affected vendors
By CVEs published in the period.