Watch ·
Bulletin for Saturday, September 12, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+7breaches, in 4 sectors+14advisories, in 11 updates4actively exploited307,275accounts affected, as reported
Deal with these first
Exploited · Software
ConnectWise ScreenConnectApply the vendor’s patch.
Critical
Florida Department of Highway Safety and Motor Vehicles (FLHSMV)These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
Exploited · Software
GitLab Community Edition and Enterprise EditionApply the vendor’s patch.
Today’s breaches 7
Public sector2
Telecoms1
Retail3
Digital services1
Today’s advisories 14
ConnectWise ScreenConnectSoftware · Exploitedvendor patch
- CVE-2026-84869Authentication bypassCritical
GitLab Community Edition and Enterprise EditionSoftware · Exploitedvendor patch
- CVE-2026-85706Path traversalCritical
JFrog ArtifactorySoftware · Exploitedvendor patch
- CVE-2026-42016Authentication bypassCritical
JFrog ArtifactorySoftware · Exploitedvendor patch
- CVE-2026-42018Authentication bypassCritical
mysql-mcp-serverPyPI · CVSS 10→ 0.4.2
pip install --upgrade "mysql-mcp-server>=0.4.2"- CVE-2026-59971Authentication bypass · CVSS 10 · < 0.4.2Critical
prowler-cloudPyPI · CVSS 9.6→ 5.30.3
pip install --upgrade "prowler-cloud>=5.30.3"- CVE-2026-59151Authentication bypass · CVSS 9.6 · < 5.30.3Critical
yaysonnpm · CVSS 9.1→ 4.3.0
npm install yayson@4.3.0- CVE-2026-61534Remote code execution · CVSS 9.1 · <= 4.2.0Critical
com.linecorp.centraldogma:centraldogma-serverMaven · Critical→ 0.84.0
- CVE-2026-11746Authentication bypass · < 0.84.0Critical
shopper/frameworkComposer · CVSS 8.8 · 4 failles→ 2.9.2
composer require "shopper/framework:>=2.9.2"- CVE-2026-56828Authentication bypass · CVSS 8.8 · >= 2.8.0, < 2.9.2High
- CVE-2026-56825Authentication bypass · CVSS 8.1 · < 2.9.2High
- CVE-2026-56827Authentication bypass · CVSS 8.1 · < 2.9.2High
- CVE-2026-56829Authentication bypass · CVSS 8.1 · < 2.9.2High
@mockoon/commons-servernpm · CVSS 8.8→ 9.7.0
npm install @mockoon/commons-server@9.7.0- CVE-2026-59148Authentication bypass · CVSS 8.8 · < 9.7.0High
mcp-from-openapinpm · CVSS 8.5→ 2.5.0
npm install mcp-from-openapi@2.5.0- CVE-2026-59973Server-side request forgery · CVSS 8.5 · >= 2.3.0, < 2.5.0High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.