Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR

Watch ·

Bulletin for Saturday, September 19, 2026

Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.

+6breaches, in 5 sectors+15advisories, in 15 updates3actively exploited852,543accounts affected, as reported

Deal with these first

  • Exploited · OS

    Linux Kernel

    Apply the vendor’s patch.

  • Critical · 732,385 accounts

    L'Orange Bleue

    Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.

  • Exploited · OS

    Linux Kernel

    Apply the vendor’s patch.

Today’s breaches 6

Retail2

Nonprofits1

Energy1

Digital services1

Education1

Today’s advisories 15

  • Linux KernelOS · Exploitedvendor patch
  • Linux KernelOS · Exploitedvendor patch
  • Linux KernelOS · Exploitedvendor patch
  • github.com/kcp-dev/kcpGo · CVSS 9.9→ 0.31.4
    go get github.com/kcp-dev/kcp@v0.31.4
  • org.xwiki.rendering:xwiki-rendering-xmlMaven · CVSS 9.9→ 14.10.2
  • lmdeployPyPI · CVSS 9.8→ 0.16.0
    pip install --upgrade "lmdeploy>=0.16.0"
    • CVE-2025-66455Unsafe deserialisation · CVSS 9.8 · >= 0.9.2, < 0.16.0Critical
  • mnemosyne-memoryPyPI · CVSS 9.1→ 3.10.1
    pip install --upgrade "mnemosyne-memory>=3.10.1"
  • anyioPyPI · Critical→ 4.14.2
    pip install --upgrade "anyio>=4.14.2"
  • github.com/obot-platform/obotGo · CVSS 8.8→ 0.23.0
    go get github.com/obot-platform/obot@v0.23.0
  • github.com/stacklok/toolhiveGo · CVSS 8.8→ 0.30.1
    go get github.com/stacklok/toolhive@v0.30.1
  • lmdeployPyPI · CVSS 8.8→ 0.12.3
    pip install --upgrade "lmdeploy>=0.12.3"
    • CVE-2026-33625Denial of service · CVSS 8.8 · >= 0.12.1, < 0.12.3High
  • org.opencastproject:opencast-engage-paella-player-7Maven · CVSS 8.7→ 19.7
  • mediawiki/semantic-media-wikiComposer · CVSS 8.6→ 7.0.0
    composer require "mediawiki/semantic-media-wiki:>=7.0.0"
    • CVE-2025-61682Cross-site scripting · CVSS 8.6 · >= 3.1.0, < 7.0.0High
  • @file-viewer/docnpm · CVSS 8.2→ 2.3.1
    npm install @file-viewer/doc@2.3.1
  • zotregistry.dev/zot/v2Go · CVSS 8.1→ 2.1.18
    go get zotregistry.dev/zot/v2@v2.1.18

Get the bulletin every morning

The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.

RSS feed

An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.