Top 10 vulnerabilities of the week (Sep 22–28, 2026): 5 actively exploited
This week's 10 most urgent vulnerabilities, including 5 CISA confirmed as actively exploited, ranked from CISA and NIST data.
Category: Cyber
Cybersecurity news from CISA, NIST, the FBI, national CERTs and vendor security teams: exploited vulnerabilities, advisories, breaches, ransomware and enforcement.
BreakingNCSC warns of active exploitation in Citrix NetScaler flaws
The UK cyber agency says two of eight newly disclosed Citrix NetScaler ADC and Gateway vulnerabilities are being actively exploited and urges immediate mitigation.
Vulnerability Watch, September 28, 2026: 8 critical CVEs and 5 new vendor and CERT advisories
Every critical-severity CVE NIST published in the past day, plus the latest advisories from national CERTs and vendors.
Vulnerability Watch, September 27, 2026: 5 critical CVEs and 3 new vendor and CERT advisories
Every critical-severity CVE NIST published in the past day, plus the latest advisories from national CERTs and vendors.
BreakingCISA Flags Two Exploited Citrix NetScaler Zero-Days in KEV List
CISA said threat actors are exploiting two critical NetScaler ADC and Gateway flaws globally, among eight vulnerabilities disclosed by Citrix.
Vulnerability Watch, September 26, 2026: 4 critical CVEs and 6 new vendor and CERT advisories
Every critical-severity CVE NIST published in the past day, plus the latest advisories from national CERTs and vendors.
BreakingMikroTik RouterOS flaw CVE-2026-67279 is being actively exploited, CISA warns
CISA added the MikroTik RouterOS vulnerability to its Known Exploited Vulnerabilities catalog on September 25, 2026, with a federal remediation deadline of September 28, 2026.
BreakingMicrosoft SharePoint flaw CVE-2026-65660 is being actively exploited, CISA warns
CISA added the Microsoft SharePoint vulnerability to its Known Exploited Vulnerabilities catalog on September 25, 2026, with a federal remediation deadline of September 28, 2026.
BreakingWordPress Core flaw CVE-2026-87902 is being actively exploited, CISA warns
CISA added the WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog on September 25, 2026, with a federal remediation deadline of September 28, 2026.