Watch ·
Bulletin for Monday, September 28, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 6 sectors+12advisories, in 11 updates2actively exploited275,556accounts affected, as reported
Deal with these first
Exploited · Network
Citrix NetScalerApply the vendor’s patch.
Critical · 42,742 accounts
KiassureExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
Exploited · Network
Citrix NetScalerApply the vendor’s patch.
Today’s breaches 10
Nonprofits2
Employment and HR2
Insurance1
Healthcare1
Digital services2
Retail2
Today’s advisories 12
Citrix NetScalerNetwork · Exploitedvendor patch
- CVE-2026-88771OtherCritical
Citrix NetScalerNetwork · Exploitedvendor patch
- CVE-2026-88772Remote code executionCritical
@rsdoctor/rspack-pluginnpm · CVSS 7.5→ 1.5.16
npm install @rsdoctor/rspack-plugin@1.5.16- CVE-2026-61782Information disclosure · CVSS 7.5 · <= 1.5.15High
github.com/containers/podman/v5Go · CVSS 7.5→ 5.8.4
go get github.com/containers/podman/v5@v5.8.4- CVE-2026-57231Information disclosure · CVSS 7.5 · < 5.8.4High
scbe-aethermoorePyPI · CVSS 7.5→ 4.2.1
pip install --upgrade "scbe-aethermoore>=4.2.1"- CVE-2026-57443Authentication bypass · CVSS 7.5 · >= 4.0.2, < 4.2.1High
starcitizenwiki/embedvideoComposer · CVSS 7.5→ 4.1.0
composer require "starcitizenwiki/embedvideo:>=4.1.0"- CVE-2026-57440Cross-site scripting · CVSS 7.5 · <= 4.0.0High
zbateson/mail-mime-parserComposer · CVSS 7.5→ 3.0.6
composer require "zbateson/mail-mime-parser:>=3.0.6"- CVE-2026-61816Denial of service · CVSS 7.5 · >= 2.0.0, < 3.0.6High
code16/sharpComposer · CVSS 7.3→ 9.22.5
composer require "code16/sharp:>=9.22.5"- CVE-2026-61823Cross-site scripting · CVSS 7.3 · < 9.22.5High
mppOther · High · 2 failles→ 0.6.0
- CVE-2026-59252Denial of service · >= 0.2.0, < 0.6.0High
- CVE-2026-59695Denial of service · >= 0.2.0, < 0.6.0High
@openzeppelin/confidential-contractsnpm · High→ 0.3.2
npm install @openzeppelin/confidential-contracts@0.3.2- GHSA-29h2-jr22-frmhOther · < 0.3.2High
khojPyPI · High→ 2.0.0-beta.25
pip install --upgrade "khoj>=2.0.0-beta.25"- GHSA-62mm-xwmv-crhgPath traversal · >= 2.0.0-beta.23, < 2.0.0-beta.25High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.