Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR

Watch ·

Bulletin for Wednesday, September 23, 2026

Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.

+9breaches, in 5 sectors+27advisories, in 18 updates4actively exploited20Maccounts affected, as reported

Deal with these first

  • Exploited · Software

    Arista VeloCloud Orchestrator

    Apply the vendor’s patch.

  • Critical · 150,000 accounts

    JIMS

    Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.

  • Exploited · Network

    Check Point Multiple Products

    Apply the vendor’s patch.

Today’s breaches 9

Retail4

Education1

Digital services2

Nonprofits1

Banking and finance1

Today’s advisories 27

  • Arista VeloCloud OrchestratorSoftware · Exploitedvendor patch
  • Check Point Multiple ProductsNetwork · Exploitedvendor patch
  • Check Point Multiple ProductsSoftware · Exploitedvendor patch
  • F5 BIG-IP APMNetwork · Exploitedvendor patch
  • mcp-atlassianPyPI · CVSS 10 · 8 failles→ 0.22.0
    pip install --upgrade "mcp-atlassian>=0.22.0"
  • lightrag-hkuPyPI · CVSS 9.1→ 1.5.5
    pip install --upgrade "lightrag-hku>=1.5.5"
  • github.com/openbao/openbaoGo · Critical→ 0.0.0-20260713141742-763625a20721
    go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721
  • homeassistantPyPI · Critical→ 2026.7.0
    pip install --upgrade "homeassistant>=2026.7.0"
  • github.com/kubeedge/kubeedgeGo · CVSS 8.8 · 3 failles→ 1.21.2
    go get github.com/kubeedge/kubeedge@v1.21.2
    • CVE-2026-62182Remote code execution · CVSS 8.8 · >= 1.21.0, < 1.21.2High
    • CVE-2026-62371Remote code execution · CVSS 8.8 · >= 1.12.0, < 1.21.2High
    • CVE-2026-62369Path traversal · CVSS 8.1 · >= 1.16.0, < 1.21.2High
  • @deepstream/servernpm · CVSS 8.8→ 10.1.1
    npm install @deepstream/server@10.1.1
  • github.com/projectdiscovery/nuclei/v3Go · CVSS 8.6→ 3.10.0
    go get github.com/projectdiscovery/nuclei/v3@v3.10.0
    • CVE-2026-76819Remote code execution · CVSS 8.6 · >= 3.0.0, < 3.10.0High
  • @sync-in/servernpm · CVSS 8.1→ 2.4.0
    npm install @sync-in/server@2.4.0
  • github.com/tinyauthapp/tinyauthGo · CVSS 8.1→ 1.0.1-0.20260720133915-80bc87188ec3
    go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260720133915-80bc87188ec3
    • CVE-2026-77560Authentication bypass · CVSS 8.1 · < 1.0.1-0.20260720133915-80bc87188ec3High
  • github.com/emiago/sipgoGo · CVSS 7.5→ 1.4.1
    go get github.com/emiago/sipgo@v1.4.1
  • github.com/emiago/sipgoGo · CVSS 7.5→ 1.4.3
    go get github.com/emiago/sipgo@v1.4.3
  • net.sf.mpxj:mpxjMaven · CVSS 7.5→ 16.4.1
  • psd-toolsPyPI · CVSS 7.5→ 1.17.4
    pip install --upgrade "psd-tools>=1.17.4"
  • request-filtering-agentnpm · CVSS 7.5→ 3.2.1
    npm install request-filtering-agent@3.2.1

Get the bulletin every morning

The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.

RSS feed

An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.