Watch ·
Bulletin for Thursday, September 10, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+8breaches, in 6 sectors+14advisories, in 12 updates4actively exploited7.8Maccounts affected, as reported
Deal with these first
Exploited · Network
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementApply the vendor’s patch.
Critical · 4.1M accounts
AdaptHealthHealth data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
Exploited · Network
Citrix NetScalerApply the vendor’s patch.
Today’s breaches 8
Healthcare2
Employment and HR2
Other1
Public sector1
Education1
Retail1
Today’s advisories 14
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementNetwork · Exploitedvendor patch
- CVE-2026-20079Authentication bypassCritical
Citrix NetScalerNetwork · Exploitedvendor patch
- CVE-2026-19490Authentication bypassCritical
Fortinet Multiple ProductsNetwork · Exploitedvendor patch
- CVE-2025-25249OtherCritical
Google Chromium V8Browser · Exploitedvendor patch
- CVE-2026-87491Remote code executionCritical
Microsoft.DiaSymReader.NativeNuGet · CVSS 8.8 · 3 failles→ 18.9.0-beta1.26405.2
dotnet add package Microsoft.DiaSymReader.Native --version 18.9.0-beta1.26405.2- CVE-2026-69439Privilege escalation · CVSS 8.8 · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1High
- CVE-2026-69522Remote code execution · CVSS 8.8 · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1High
- CVE-2026-71328Remote code execution · CVSS 8.8 · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1High
@yeger/turbo-graphnpm · CVSS 8.8→ 2.8.12
npm install @yeger/turbo-graph@2.8.12- CVE-2026-59160Authentication bypass · CVSS 8.8 · <= 2.8.8High
esphome-device-builderPyPI · CVSS 8.8→ 1.0.10
pip install --upgrade "esphome-device-builder>=1.0.10"- CVE-2026-59177Remote code execution · CVSS 8.8 · < 1.0.10High
github.com/komari-monitor/komariGo · CVSS 8.8→ 0.0.0-20260609084633-98122fa4d110
go get github.com/komari-monitor/komari@v0.0.0-20260609084633-98122fa4d110- GHSA-hxjg-93wc-h8p8Server-side request forgery · CVSS 8.8 · < 0.0.0-20260609084633-98122fa4d110High
github.com/identrail/identrailGo · CVSS 8.5→ 1.0.2
go get github.com/identrail/identrail@v1.0.2- CVE-2026-59185Authentication bypass · CVSS 8.5 · < 1.0.2High
@openhop/servernpm · CVSS 8.3→ 0.3.6
npm install @openhop/server@0.3.6- CVE-2026-59179Path traversal · CVSS 8.3 · <= 0.3.5High
functype-mcp-servernpm · CVSS 7.8→ 1.4.4
npm install functype-mcp-server@1.4.4- CVE-2026-59176Supply chain · CVSS 7.8 · <= 1.4.3High
github.com/candid82/jokerGo · CVSS 7.8→ 1.8.2
go get github.com/candid82/joker@v1.8.2- CVE-2026-59172Supply chain · CVSS 7.8 · < 1.8.2High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.