Watch ·
Bulletin for Friday, September 25, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 6 sectors+17advisories, in 14 updates2actively exploited353,843accounts affected, as reported
Deal with these first
Exploited · Software
Adobe Commerce and MagentoApply the vendor’s patch.
Critical · 143,518 accounts
Agence de services et de paiement (ASP)Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
Exploited · Software
WSO2 Multiple ProductsApply the vendor’s patch.
Today’s breaches 10
Public sector3
Employment and HR2
Healthcare1
Digital services1
Nonprofits1
Retail2
Today’s advisories 17
Adobe Commerce and MagentoSoftware · Exploitedvendor patch
- CVE-2026-71362Authentication bypassCritical
WSO2 Multiple ProductsSoftware · Exploitedvendor patch
- CVE-2026-5430Cryptographic weaknessCritical
decepticon-corePyPI · CVSS 10→ 1.1.17
pip install --upgrade "decepticon-core>=1.1.17"- CVE-2026-61732Other · CVSS 10 · <= 1.1.16Critical
suneditornpm · CVSS 10→ 2.47.11
npm install suneditor@2.47.11- CVE-2026-59167Cross-site scripting · CVSS 10 · <= 2.47.10Critical
org.http4s:http4s-scala-xml_2.12Maven · CVSS 9.3→ 0.24.1
- CVE-2026-61741Server-side request forgery · CVSS 9.3 · <= 0.24.0Critical
@bytebase/dbhubnpm · Critical→ 0.22.5
npm install @bytebase/dbhub@0.22.5- CVE-2026-61742Authentication bypass · <= 0.22.4Critical
github.com/ixofoundation/ixo-blockchain/v8Go · Critical→ 8.0.0
go get github.com/ixofoundation/ixo-blockchain/v8@v8.0.0- CVE-2026-61604Authentication bypass · < 8.0.0Critical
clinenpm · CVSS 8.8→ 3.0.30
npm install cline@3.0.30- CVE-2026-59723Other · CVSS 8.8 · < 3.0.30High
github.com/zitadel/zitadelGo · CVSS 8.7 · 2 failles→ 1.80.0-v2.20.0.20260717062356-56f4798ed31f
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062356-56f4798ed31f- CVE-2026-85057Other · CVSS 8.7 · < 1.80.0-v2.20.0.20260717062331-baf6ed501b68 · → 1.80.0-v2.20.0.20260717062331-baf6ed501b68High
- CVE-2026-85056Other · CVSS 8.2 · < 1.80.0-v2.20.0.20260717062356-56f4798ed31fHigh
snipe/snipe-itComposer · CVSS 8.7 · 2 failles→ 8.7.0
composer require "snipe/snipe-it:>=8.7.0"- CVE-2026-63498Cross-site scripting · CVSS 8.7 · < 8.7.0High
- CVE-2026-62368Cross-site scripting · CVSS 8.1 · < 8.7.0High
compliance-trestlePyPI · CVSS 8.4 · 2 failles→ 3.12.4
pip install --upgrade "compliance-trestle>=3.12.4"- CVE-2026-57171Path traversal · CVSS 8.4 · < 3.12.4High
- CVE-2026-57170Remote code execution · CVSS 7.8 · < 3.12.4High
thorsten/phpmyfaqComposer · CVSS 8.2→ 4.2.0-alpha
composer require "thorsten/phpmyfaq:>=4.2.0-alpha"- CVE-2026-56736Cross-site scripting · CVSS 8.2 · < 4.2.0-alphaHigh
thorsten/phpmyfaqComposer · CVSS 8.1→ 4.1.6
composer require "thorsten/phpmyfaq:>=4.1.6"- CVE-2026-56737Authentication bypass · CVSS 8.1 · >= 3.2.0, < 4.1.6High
@aws/lsp-codewhisperernpm · CVSS 7.8→ 0.0.117
npm install @aws/lsp-codewhisperer@0.0.117- CVE-2026-12958Path traversal · CVSS 7.8 · < 0.0.117High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.