Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR

Watch ·

Bulletin for Thursday, September 24, 2026

Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.

+6breaches, in 6 sectors+10advisories, in 7 updates0actively exploited28,338accounts affected, as reported

Deal with these first

  • CVSS 9.9 · RubyGems

    openc3

    2 failles · fixed in 7.3.0

  • Critical · 10,758 accounts

    Activa Assurances

    Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.

  • CVSS 9.9 · PyPI

    plone.app.portlets

    Fixed in 7.0.2

    pip install --upgrade "plone.app.portlets>=7.0.2"

Today’s breaches 6

Insurance1

Retail1

Public sector1

Healthcare1

Other1

Digital services1

Today’s advisories 10

  • openc3RubyGems · CVSS 9.9 · 2 failles→ 7.3.0
    • CVE-2026-77602Remote code execution · CVSS 9.9 · >= 5.1.0, <= 7.2.1Critical
    • CVE-2026-77601Remote code execution · CVSS 8.8 · >= 5.12.0, <= 7.2.1High
  • plone.app.portletsPyPI · CVSS 9.9→ 7.0.2
    pip install --upgrade "plone.app.portlets>=7.0.2"
    • CVE-2026-57149Remote code execution · CVSS 9.9 · >= 7.0.0, <= 7.0.1Critical
  • io.moquette:moquette-brokerMaven · CVSS 9.6→ 0.18.1
  • github.com/klever-io/klever-goGo · CVSS 8.6→ 1.7.20
    go get github.com/klever-io/klever-go@v1.7.20
  • verbb/formieComposer · CVSS 8.5 · 3 failles→ 3.1.31
    composer require "verbb/formie:>=3.1.31"
    • CVE-2026-76086Server-side request forgery · CVSS 8.5 · >= 3.0.0, < 3.1.31High
    • CVE-2026-76087Authentication bypass · CVSS 8.2 · >= 3.0.0, < 3.1.31High
    • CVE-2026-76089Authentication bypass · CVSS 7.7 · >= 3.0.0, < 3.1.31High
  • 9routernpm · CVSS 8.3→ 0.5.2
    npm install 9router@0.5.2
  • @openc3/vue-commonnpm · CVSS 7.6→ 7.3.0
    npm install @openc3/vue-common@7.3.0
    • CVE-2026-77394Cross-site scripting · CVSS 7.6 · >= 5.0.6, <= 7.2.1High

Get the bulletin every morning

The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.

RSS feed

An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.