Vulnerability intelligence

CVE-2026-61500 describes a vulnerability affecting Rejetto HFS versions 3.0.0 through 3.2.0. The flaw stems from the application's use of the non-cryptographic `Math.random()` generator to create session-cookie signing keys. Additionally, outputs from this same generator are disclosed to unauthenticated clients during the login process. A remote attacker can exploit this by collecting a small number of login responses to reconstruct the state of the `Math.random()` generator. This allows them to recover the session-cookie signing key and subsequently forge a valid administrator session cookie. With a forged administrator session, an attacker can gain full administrative access and achieve remote code execution via the `server_code` configuration feature.

CVE-2026-88772 is a memory overflow vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw can result in remote code execution (RCE) or a denial-of-service (DoS) condition. The vulnerability specifically affects appliances where Datagram Transport Layer Security (DTLS) is enabled. DTLS is typically enabled by default for VPN virtual servers, meaning NetScaler Gateway deployments are susceptible unless DTLS has been explicitly disabled. Citrix has confirmed that this vulnerability, alongside CVE-2026-88771, has been actively exploited in unmitigated NetScaler deployments.

CVE-2026-102676 describes a vulnerability within the Electron framework, which is used for developing cross-platform desktop applications with JavaScript, HTML, and CSS. Prior to versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron `<webview>` guest could enable `nodeIntegrationInWorker` for its Web Workers. This was possible even if the unsandboxed embedder had Node.js integration disabled, potentially allowing untrusted guest content to create a Node-enabled worker with elevated privileges beyond what the embedder intended. Applications that do not utilize the `<webview>` tag or those that maintain a sandboxed embedder are not affected by this issue. The vulnerability has been addressed in the specified Electron versions.

CVE-2026-76504 is an API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The issue arises from the improper handling of URI/URL encoding in HTTP requests. An unauthenticated, remote attacker can exploit this flaw by sending a crafted HTTP request to the affected system's API. This allows the request to bypass an authentication rule designed to restrict access to a specific API endpoint, granting the attacker access to the API with administrative privileges without requiring any credentials. The vulnerability affects Cisco Catalyst SD-WAN Manager regardless of its system configuration. Cisco discovered the issue through a customer support case and confirmed that it is being actively exploited in the wild. Consequently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to its Known Exploited Vulnerabilities (KEV) catalog on September 30, 2026. Cisco has released software updates to address the flaw, and because no workarounds are available, organizations are advised to apply the patches to secure their systems.

CVE-2026-86950 is an out-of-bounds write vulnerability found within Apple's CoreGraphics framework. This flaw allows for memory corruption and can potentially lead to arbitrary code execution if a device processes a specially crafted file. The CoreGraphics component is fundamental to Apple operating systems, handling the rendering of 2D content such as images and PDF documents. Apple addressed this issue by implementing improved bounds checking in affected versions of iOS, iPadOS, and macOS. The vulnerability was reported to Apple by Meta Product Security. Apple has acknowledged reports suggesting that this issue may have been exploited in highly targeted attacks against specific individuals on older versions of iOS.

CVE-2026-88772 is a memory overflow vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw can result in remote code execution (RCE) or a denial-of-service (DoS) condition. The vulnerability specifically affects appliances where Datagram Transport Layer Security (DTLS) is enabled. DTLS is typically enabled by default for VPN virtual servers, meaning NetScaler Gateway deployments are susceptible unless DTLS has been explicitly disabled. Citrix has confirmed that this vulnerability, alongside CVE-2026-88771, has been actively exploited in unmitigated NetScaler deployments.