Watch ·
Bulletin for Thursday, October 1, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 6 sectors+14advisories, in 11 updates1actively exploited2.1Maccounts affected, as reported
Deal with these first
Exploited · Network
Cisco Catalyst SD-WAN ManagerApply the vendor’s patch.
Critical
Centre National de l'Expertise Hospitalière (CNEH)Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
Critical · npm
nextFixed in 16.3.6
npm install next@16.3.6
Today’s breaches 10
Healthcare3
Retail1
Nonprofits1
Public sector3
Education1
Digital services1
Today’s advisories 14
Cisco Catalyst SD-WAN ManagerNetwork · Exploitedvendor patch
- CVE-2026-76504OtherCritical
nextnpm · Critical→ 16.3.6
npm install next@16.3.6- GHSA-vcvr-r3jv-pc5jRemote code execution · >= 16.2.0, < 16.3.6Critical
gitpythonPyPI · CVSS 8.8→ 3.1.60
pip install --upgrade "gitpython>=3.1.60"- CVE-2026-87817Remote code execution · CVSS 8.8 · <= 3.1.59High
fastifynpm · CVSS 8.1 · 4 failles→ 5.12.2
npm install fastify@5.12.2- CVE-2026-84504Other · CVSS 8.1 · < 5.12.2High
- CVE-2026-76169Authentication bypass · CVSS 7.5 · >= 4.0.0, < 5.12.2High
- CVE-2026-84428Other · CVSS 7.5 · < 5.12.2High
- CVE-2026-84469Other · CVSS 7.5 · < 5.12.2High
com.fasterxml.jackson.core:jackson-databindMaven · CVSS 7.5→ 2.18.11
- CVE-2026-91776Denial of service · CVSS 7.5 · >= 2.0.0, <= 2.18.10High
com.fasterxml.jackson.core:jackson-databindMaven · CVSS 7.5→ 2.21.7
- CVE-2026-91777Denial of service · CVSS 7.5 · >= 2.19.0, <= 2.21.6High
GitPythonPyPI · CVSS 7.5→ 3.1.60
pip install --upgrade "GitPython>=3.1.60"- CVE-2026-87819Denial of service · CVSS 7.5 · <= 3.1.59High
league/commonmarkComposer · CVSS 7.5→ 2.10.2
composer require "league/commonmark:>=2.10.2"- CVE-2026-105830Denial of service · CVSS 7.5 · >= 2.0.0, <= 2.10.1High
nodemailernpm · CVSS 7.5→ 10.0.5
npm install nodemailer@10.0.5- CVE-2026-90776Denial of service · CVSS 7.5 · >= 9.1.0, <= 10.0.4High
russhRust · CVSS 7.5→ 0.63.1
- CVE-2026-102823Denial of service · CVSS 7.5 · <= 0.63.0High
tornadoPyPI · CVSS 7.5→ 6.5.9
pip install --upgrade "tornado>=6.5.9"- CVE-2026-103262Denial of service · CVSS 7.5 · <= 6.5.8High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.