Trending now

CVE-2026-88771 is identified as an improper input validation vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway products. This flaw enables an unauthenticated attacker to execute arbitrary commands on affected systems. The vulnerability impacts all deployments of NetScaler ADC and NetScaler Gateway, and no specific additional features are required for it to be exploitable. Citrix confirmed that this vulnerability, alongside CVE-2026-88772, has been actively exploited in the wild on unmitigated NetScaler deployments. The company released security updates to address these issues, which were attacked before a public fix was available. NetScaler ADC and NetScaler Gateway appliances are commonly deployed at the edge of enterprise networks, handling functions such as VPN, remote access, load balancing, and user authentication.

CVE-2026-88772 is a memory overflow vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw can result in remote code execution (RCE) or a denial-of-service (DoS) condition. The vulnerability specifically affects appliances where Datagram Transport Layer Security (DTLS) is enabled. DTLS is typically enabled by default for VPN virtual servers, meaning NetScaler Gateway deployments are susceptible unless DTLS has been explicitly disabled. Citrix has confirmed that this vulnerability, alongside CVE-2026-88771, has been actively exploited in unmitigated NetScaler deployments.

CVE-2026-86060 is an argument-handling flaw identified in MikroTik RouterOS, specifically within its SSH login path. This vulnerability arises when usernames begin with a prohibited character, which can be manipulated to alter the trusted RouterOS policy mask. Such a change ultimately leads to privilege escalation within the system. Exploitation of CVE-2026-86060 requires an unauthenticated SSH session to successfully reach the RouterOS login helper. This flaw is often discussed in conjunction with CVE-2026-67276, an SSH authentication bypass, as chaining these two vulnerabilities can allow an attacker to gain full, unauthenticated control over affected MikroTik devices. MikroTik has released fixes for this issue in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

CVE-2026-67279 describes a vulnerability in MikroTik RouterOS SSH where the system improperly handles a client-requested rekey operation. This flaw allows the SSH server to proceed to the connection protocol stage and accept session channel requests, even though user authentication has not been completed. As a result, an unauthenticated client can open an SSH session channel and issue `exec` requests. This capability permits the creation, overwriting, and reconstruction of files within the RouterOS managed file namespace, including critical configuration and diagnostic data.

CVE-2026-88778 is identified as a TCP Initial Sequence Number (ISN) prediction flaw affecting Citrix NetScaler ADC and NetScaler Gateway appliances. This vulnerability specifically impacts devices configured with TCP-based virtual servers, such as those handling HTTP, SSL, or generic TCP traffic, when the "Enhanced ISN Generation" feature is disabled. To address this issue, Citrix advises applying software updates and implementing a configuration change to enable Enhanced ISN Generation on affected appliances.

It appears there might be a slight typo in the CVE number provided. Based on popular articles, a vulnerability identified as CVE-2025-12183 has been widely discussed. This vulnerability affects `org.lz4:lz4-java` versions 1.8.0 and earlier. CVE-2025-12183 involves out-of-bounds memory operations, which can be triggered by remote attackers providing untrusted compressed input. This flaw can lead to a denial of service and allow attackers to read adjacent memory. The issue specifically impacts programs utilizing the `LZ4_decompress_fast` API, also known as the "fast" decompressor, which lacks boundary checks when processing untrusted inputs.

CVE-2026-91768 describes an IPv6 access control bypass vulnerability found in PHP-FPM. This flaw specifically affects the `listen.allowed_clients` configuration due to a partial address comparison mechanism. The vulnerability allows clients to circumvent intended IPv6 Access Control List (ACL) restrictions. This issue has been noted in the context of unpatched Linux distributions, including Debian Linux, and is associated with PHP versions such as php8.2 and php8.4. It is also listed among multiple vulnerabilities affecting PHP 8.3.x versions prior to 8.3.35.

CVE-2026-91769 describes a vulnerability within OpenSSL's TLS hostname verification process, specifically as it pertains to PHP. The issue arises when the system incorrectly falls back to verifying the common name (CN) in a TLS certificate, even after a mismatch has been detected with the subject alternative name (SAN). This flaw, identified as "TLS hostname verification falls back to CN after SAN mismatch," has been addressed in PHP. Users are advised to upgrade to PHP version 8.3.35 or later to mitigate this vulnerability.

CVE-2026-65660 is a vulnerability affecting Microsoft Office SharePoint, specifically SharePoint Server 2016, 2019, and Subscription Edition, with potential impact on SharePoint 2013. This flaw stems from an improper control of code generation, characterized as a 'code injection' vulnerability. It involves a parser desynchronization issue within SharePoint's `SafeControls` filter, which is designed to prevent the loading of dangerous classes. The vulnerability arises when the `ToolPane` component processes web-part markup, failing to properly escape quotes within attribute values when reconstructing `Register` directives. This oversight allows an attacker to inject additional directives through unescaped quotes, enabling the registration of arbitrary .NET classes. While initially described by Microsoft as a spoofing vulnerability, further technical analysis revealed that CVE-2026-65660 can lead to authenticated remote code execution (RCE). Researchers have also demonstrated that this flaw can be chained with other vulnerabilities to achieve pre-authentication remote code execution on servers configured to allow anonymous page access.

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.