Watch ·
Bulletin for Friday, September 18, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+5breaches, in 2 sectors+21advisories, in 17 updates0actively exploited24Maccounts affected, as reported
Deal with these first
CVSS 9.8 · Composer
chamilo/chamilo-lmsFixed in 2.0.1
composer require "chamilo/chamilo-lms:>=2.0.1"Critical
Ville de LibercourtThese documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
CVSS 9.1 · npm
@vendure/coreFixed in 3.7.0
npm install @vendure/core@3.7.0
Today’s breaches 5
Public sector3
Digital services2
Today’s advisories 21
chamilo/chamilo-lmsComposer · CVSS 9.8→ 2.0.1
composer require "chamilo/chamilo-lms:>=2.0.1"- CVE-2026-45140Remote code execution · CVSS 9.8 · <= 2.0.0Critical
@vendure/corenpm · CVSS 9.1→ 3.7.0
npm install @vendure/core@3.7.0- CVE-2026-63472Authentication bypass · CVSS 9.1 · < 3.7.0Critical
getgrav/gravComposer · CVSS 9.1→ 2.0.14
composer require "getgrav/grav:>=2.0.14"- CVE-2026-75837Authentication bypass · CVSS 9.1 · < 2.0.14Critical
MartenNuGet · CVSS 9.1→ 9.13.0
dotnet add package Marten --version 9.13.0- CVE-2026-75513Injection · CVSS 9.1 · >= 7.0.0, <= 9.12.0Critical
github.com/rabbitmq/amqp091-goGo · Critical · 3 failles→ 1.13.0
go get github.com/rabbitmq/amqp091-go@v1.13.0- CVE-2026-77405Cryptographic weakness · < 1.13.0Critical
- CVE-2026-77408Other · < 1.13.0Critical
- CVE-2026-77411Remote code execution · < 1.13.0Critical
cakephp/databaseComposer · Critical→ 4.5.12
composer require "cakephp/database:>=4.5.12"- CVE-2026-79752Injection · < 4.5.12Critical
getgrav/gravComposer · CVSS 8.8 · 2 failles→ 2.0.15
composer require "getgrav/grav:>=2.0.15"- CVE-2026-75827Remote code execution · CVSS 8.8 · <= 2.0.14High
- CVE-2026-75828Cross-site scripting · CVSS 8.7 · <= 2.0.14High
@tinacms/authnpm · CVSS 8.8→ 1.1.4
npm install @tinacms/auth@1.1.4- CVE-2026-63506Authentication bypass · CVSS 8.8 · <= 1.1.3High
getgrav/gravComposer · CVSS 8.8→ 2.0.9
composer require "getgrav/grav:>=2.0.9"- CVE-2026-65608Remote code execution · CVSS 8.8 · >= 1.7.0, < 2.0.9High
getgrav/gravComposer · CVSS 8.8→ 2.0.13
composer require "getgrav/grav:>=2.0.13"- CVE-2026-72819Remote code execution · CVSS 8.8 · < 2.0.13High
oras.land/oras-go/v2Go · CVSS 8.8→ 2.6.2
go get oras.land/oras-go/v2@v2.6.2- CVE-2026-85731Path traversal · CVSS 8.8 · <= 2.6.1High
@vendure/dashboardnpm · CVSS 8.7→ 3.6.5
npm install @vendure/dashboard@3.6.5- CVE-2026-63459Cross-site scripting · CVSS 8.7 · < 3.6.5High
io.kestra:coreMaven · CVSS 8.6vendor patch
- CVE-2026-73247Server-side request forgery · CVSS 8.6 · <= 1.3.31High
RestrictedPythonPyPI · CVSS 8.4→ 8.4
pip install --upgrade "RestrictedPython>=8.4"- CVE-2026-76825Remote code execution · CVSS 8.4 · < 8.4High
@libp2p/peer-storenpm · CVSS 8.2→ 12.0.24
npm install @libp2p/peer-store@12.0.24- CVE-2026-86039Authentication bypass · CVSS 8.2 · >= 8.0.0, < 12.0.24High
getgrav/gravComposer · CVSS 8.1 · 2 failles→ 2.0.16
composer require "getgrav/grav:>=2.0.16"- CVE-2026-72695Path traversal · CVSS 8.1 · <= 2.0.15High
- CVE-2026-76839Authentication bypass · CVSS 7.7 · <= 2.0.15High
getgrav/gravComposer · CVSS 8.1→ 2.0.11
composer require "getgrav/grav:>=2.0.11"- CVE-2026-69088Remote code execution · CVSS 8.1 · >= 2.0.7, <= 2.0.10High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.