Watch ·
Bulletin for Monday, September 21, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
Deal with these first
Critical · 105,251 accounts
FaktusChange that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
Critical · 93,493 accounts
Fédération Française de SpéléologieExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
Critical · 49,984 accounts
VitalAireExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
Today’s breaches 10
Retail4
Healthcare3
Banking and finance1
Nonprofits1
Transport and travel1
Today’s advisories 11
github.com/obot-platform/obotGo · CVSS 7.6→ 0.23.0
go get github.com/obot-platform/obot@v0.23.0- CVE-2026-101064Server-side request forgery · CVSS 7.6 · < 0.23.0High
adm-zipnpm · CVSS 7.5→ 0.6.1
npm install adm-zip@0.6.1- CVE-2026-77301Denial of service · CVSS 7.5 · < 0.6.1High
io.moquette:moquette-brokerMaven · CVSS 7.5→ 0.18.1
- CVE-2026-85058Authentication bypass · CVSS 7.5 · < 0.18.1High
lmdeployPyPI · CVSS 7.5→ 0.15.0
pip install --upgrade "lmdeploy>=0.15.0"- GHSA-39wr-7q6h-cf68Server-side request forgery · CVSS 7.5 · >= 0.12.3, < 0.15.0High
mediawiki/semantic-media-wikiComposer · CVSS 7.3→ 7.3.0
composer require "mediawiki/semantic-media-wiki:>=7.3.0"- GHSA-jr78-w6w5-m8f8Authentication bypass · CVSS 7.3 · >= 3.0.0, <= 7.2.1High
github.com/projectcapsule/capsuleGo · CVSS 7.1→ 0.13.7
go get github.com/projectcapsule/capsule@v0.13.7- CVE-2026-61672Authentication bypass · CVSS 7.1 · <= 0.13.6High
github.com/perses/persesGo · High · 2 failles→ 0.54.0-rc.0
go get github.com/perses/perses@v0.54.0-rc.0- CVE-2026-63199Authentication bypass · >= 0.43.0, < 0.54.0-rc.0High
- CVE-2026-63445Path traversal · < 0.54.0-rc.0High
anyioPyPI · High→ 4.14.2
pip install --upgrade "anyio>=4.14.2"- CVE-2026-63349Privilege escalation · >= 4.14.0, < 4.14.2High
github.com/frain-dev/convoyGo · High→ 0.9.3-0.20260724092134-1cc67cd16fb1
go get github.com/frain-dev/convoy@v0.9.3-0.20260724092134-1cc67cd16fb1- CVE-2026-81505Authentication bypass · < 0.9.3-0.20260724092134-1cc67cd16fb1High
github.com/perses/persesGo · High→ 0.54.0-beta.3
go get github.com/perses/perses@v0.54.0-beta.3- CVE-2026-63458Authentication bypass · < 0.54.0-beta.3High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.