Watch ·
Bulletin for Friday, September 11, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+8breaches, in 5 sectors+15advisories, in 10 updates2actively exploited167Maccounts affected, as reported
Deal with these first
Exploited · OS
MikroTik RouterOSApply the vendor’s patch.
Critical · 153M accounts
IDScanThese documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
Exploited · Network
MikroTik RouterOSApply the vendor’s patch.
Today’s breaches 8
Digital services3
Healthcare2
Public sector1
Industry1
Education1
Today’s advisories 15
MikroTik RouterOSOS · Exploitedvendor patch
- CVE-2026-67277Authentication bypassCritical
MikroTik RouterOSNetwork · Exploitedvendor patch
- CVE-2026-86060Remote code executionCritical
github.com/rclone/rcloneGo · CVSS 9.8 · 3 failles→ 1.75.1
go get github.com/rclone/rclone@v1.75.1- CVE-2026-88018Authentication bypass · CVSS 9.8 · < 1.75.1Critical
- CVE-2026-88044Authentication bypass · CVSS 9.1 · >= 1.70.0, < 1.75.1Critical
- CVE-2026-88045Other · CVSS 7.5 · = 1.75.0High
github.com/traefik/traefik/v3Go · Critical→ 3.7.13
go get github.com/traefik/traefik/v3@v3.7.13- CVE-2026-88007Authentication bypass · >= 3.0.0, < 3.7.13Critical
omniroutenpm · Criticalvendor patch
- CVE-2026-88062Remote code execution · <= 3.8.50Critical
pimcore/pimcoreComposer · CVSS 8.8→ 2026.1.6
composer require "pimcore/pimcore:>=2026.1.6"- CVE-2026-55416Injection · CVSS 8.8 · >= 2026.1.0, <= 2026.1.5High
open-webuiPyPI · CVSS 8.7 · 4 failles→ 0.11.1
pip install --upgrade "open-webui>=0.11.1"- CVE-2026-87995Cross-site scripting · CVSS 8.7 · >= 0.8.11, <= 0.11.0High
- CVE-2026-87016Authentication bypass · CVSS 8.1 · >= 0.6.41, < 0.11.1High
- CVE-2026-87996Server-side request forgery · CVSS 7.7 · >= 0.9.6, < 0.11.1High
- CVE-2026-87011Denial of service · CVSS 7.5 · >= 0.9.0, <= 0.11.0High
@eigenpal/docx-editor-corenpm · CVSS 8.1→ 1.8.3
npm install @eigenpal/docx-editor-core@1.8.3- GHSA-x7m8-jrm8-hpvxCross-site scripting · CVSS 8.1 · <= 1.8.2High
@argos-ci/corenpm · CVSS 7.5→ 6.2.1
npm install @argos-ci/core@6.2.1- CVE-2026-59960Remote code execution · CVSS 7.5 · <= 6.2.0High
mistralrs-server-coreRust · CVSS 7.5→ 0.8.18
- GHSA-m3wp-48jr-vr4gDenial of service · CVSS 7.5 · <= 0.8.4High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.