Vulnerability Intelligence

Reviewed CVE records, security advisories and in-depth analysis — every entry linked to its official source.

Published records349
Critical309
High30
Known exploited77

CVE-2026-88771

Critical9.8

Citrix Netscaler Application Delivery Controller >= 13.1, < 13.1-64.23

Citrix NetScaler Improper Input Validation Vulnerability

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37…

Known exploited (KEV)Improper input validationRemote (network)No login neededNo user action

Citrix Netscaler Application Delivery Controller >= 13.1, < 13.1-64.23

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading…

Known exploited (KEV)Memory corruptionRemote (network)No login neededNo user action

CVE-2026-88776

Critical9.8

Citrix Netscaler Application Delivery Controller >= 13.1, < 13.1-64.23

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37…

Memory corruptionRemote (network)No login neededNo user action

CVE-2026-89134

Critical9.1

Wolfssl Wolfssl 5.9.2

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL &&…

Improper certificate validationRemote (network)No login neededNo user action

CVE-2026-88777

Critical9.8

Citrix Netscaler Application Delivery Controller >= 13.1, < 13.1-64.23

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37…

Memory corruptionRemote (network)No login neededNo user action

CVE-2026-100833

Critical9.6

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts…

Improper input validationRemote (network)Login neededNo user action

CVE-2026-88773

Critical10.0

Citrix Netscaler Application Delivery Controller >= 13.1, < 13.1-64.23

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and…

CWE-444Remote (network)No login neededNo user action

CVE-2026-88775

Critical9.8

Citrix Netscaler Application Delivery Controller >= 13.1, < 13.1-64.23

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and…

Buffer overflowRemote (network)No login neededNo user action

CVE-2026-94130

Critical9.8

Joomlaboat Youtube Gallery < 5.7.3

Joomla Extension – joomlaboat.com – Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 – An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in…

SQL injectionRemote (network)No login neededNo user action

CVE-2026-97162

Critical9.8

Lomart Up >= 5.0.0, = 6.0.0, <= 6.0.29

Joomla Extension – lomart.fr – Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

SQL injectionRemote (network)No login neededNo user action