Watch ·
Bulletin for Wednesday, September 16, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+8breaches, in 5 sectors+13advisories, in 8 updates0actively exploited7Maccounts affected, as reported
Deal with these first
CVSS 9.6 · npm
@zereight/mcp-gitlab2 failles · fixed in 2.1.30
npm install @zereight/mcp-gitlab@2.1.30Critical · 6.8M accounts
AlaxioneExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
CVSS 9.6 · npm
@zereight/mcp-gitlabFixed in 2.1.27
npm install @zereight/mcp-gitlab@2.1.27
Today’s breaches 8
Nonprofits3
Education2
Healthcare1
Public sector1
Retail1
Today’s advisories 13
@zereight/mcp-gitlabnpm · CVSS 9.6 · 2 failles→ 2.1.30
npm install @zereight/mcp-gitlab@2.1.30- CVE-2026-61568Other · CVSS 9.6 · < 2.1.30Critical
- GHSA-5648-rgj9-v224Authentication bypass · CVSS 8.1 · < 2.1.30High
@zereight/mcp-gitlabnpm · CVSS 9.6→ 2.1.27
npm install @zereight/mcp-gitlab@2.1.27- CVE-2026-61559Server-side request forgery · CVSS 9.6 · >= 0.0.1, < 2.1.27Critical
org.http4s:http4s-ember-core_2.12Maven · CVSS 7.5 · 5 failles→ 0.23.35
- CVE-2026-69204Other · <= 0.23.34Critical
- CVE-2026-69202Denial of service · CVSS 7.5 · <= 0.23.34High
- CVE-2026-69203Denial of service · CVSS 7.5 · <= 0.23.34High
- CVE-2026-69213Denial of service · CVSS 7.5 · <= 0.23.34High
- CVE-2026-69218Denial of service · CVSS 7.5 · <= 0.23.34High
org.http4s:http4s-ember-core_3Maven · CVSS 8.7→ 0.23.35
- CVE-2026-69205Other · CVSS 8.7 · <= 0.23.34High
github.com/jm33-m0/emp3r0r/coreGo · CVSS 7.5→ 0.0.0-20260531142011-aed3d81641ab
go get github.com/jm33-m0/emp3r0r/core@v0.0.0-20260531142011-aed3d81641ab- CVE-2026-61554Denial of service · CVSS 7.5 · < 0.0.0-20260531142011-aed3d81641abHigh
org.http4s:http4s-ember-core_2.13Maven · CVSS 7.5→ 0.23.37
- CVE-2026-88975Denial of service · CVSS 7.5 · <= 0.23.36High
org.http4s:http4s-ember-server_2.12Maven · CVSS 7.5→ 0.23.35
- CVE-2026-69208Denial of service · CVSS 7.5 · <= 0.23.34High
libp2p-quicRust · High→ 0.13.1
- CVE-2026-61544Denial of service · < 0.13.1High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.