Watch ·
Bulletin for Friday, October 2, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 7 sectors+21advisories, in 9 updates1actively exploited768,773accounts affected, as reported
Deal with these first
Exploited · Network
Fortinet FortiMailApply the vendor’s patch.
Critical · 5,405 accounts
Région Centre-Val de LoireExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
CVSS 10 · npm
vm212 failles · fixed in 3.11.7
npm install vm2@3.11.7
Today’s breaches 10
Public sector3
- Région Centre-Val de LoireSSN · banking · birth date · address5,405Confirmed
- SDIS 66 (Service départemental d'incendie et de secours des Pyrénées-Orientales)ID document · SSN · health · address—Confirmed
- Région Bourgogne-Franche-Comté — Carte Avantages Jeunesaddress · birth date · email · name318,000Confirmed
Healthcare1
Retail2
Media and leisure1
Employment and HR1
Education1
Digital services1
Today’s advisories 21
Fortinet FortiMailNetwork · Exploitedvendor patch
- CVE-2026-104286Path traversalCritical
vm2npm · CVSS 10 · 12 failles→ 3.11.7
npm install vm2@3.11.7- CVE-2026-92937Remote code execution · CVSS 10 · = 3.11.6Critical
- CVE-2026-92940Other · CVSS 10 · >= 3.11.3, <= 3.11.6Critical
- CVE-2026-92941Authentication bypass · CVSS 10 · >= 3.11.3, <= 3.11.6Critical
- CVE-2026-92938Other · CVSS 9.9 · >= 3.11.3, <= 3.11.6Critical
- CVE-2026-92939Cryptographic weakness · CVSS 9.9 · >= 3.11.3, <= 3.11.6Critical
- CVE-2026-92948Remote code execution · CVSS 9.9 · >= 3.9.6, <= 3.11.6Critical
- CVE-2026-92951Authentication bypass · CVSS 9.9 · <= 3.11.6Critical
- CVE-2026-92957Privilege escalation · CVSS 9.9 · <= 3.11.6Critical
- CVE-2026-92944Other · CVSS 9.8 · >= 3.10.2, <= 3.11.6Critical
- CVE-2026-92935Remote code execution · CVSS 9 · >= 3.11.4, <= 3.11.6Critical
- CVE-2026-92950Supply chain · CVSS 8.6 · <= 3.11.6High
- CVE-2026-92958Privilege escalation · CVSS 8.5 · <= 3.11.6High
github.com/siyuan-note/siyuan/kernelGo · CVSS 10 · 2 failles→ 0.0.0-20260812083335-251596fc0de2
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260812083335-251596fc0de2- CVE-2026-69085Injection · CVSS 10 · < 0.0.0-20260721043339-eef10568384e · → 0.0.0-20260721043339-eef10568384eCritical
- GHSA-9cqf-hhrq-7v45Authentication bypass · CVSS 8.6 · >= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2High
piscinanpm · Critical→ 5.3.2
npm install piscina@5.3.2- CVE-2026-102992Remote code execution · >= 5.0.0, < 5.3.2Critical
jupyterlabPyPI · CVSS 8.1→ 4.6.4
pip install --upgrade "jupyterlab>=4.6.4"- CVE-2026-102831Cross-site scripting · CVSS 8.1 · >= 4.6.0, <= 4.6.3High
virtualenvPyPI · CVSS 7.8→ 21.7.13
pip install --upgrade "virtualenv>=21.7.13"- CVE-2026-102925Remote code execution · CVSS 7.8 · <= 21.7.12High
com.fasterxml.jackson.core:jackson-coreMaven · CVSS 7.5→ 2.18.11
- CVE-2026-89407Denial of service · CVSS 7.5 · >= 2.17.0, <= 2.18.10High
com.fasterxml.jackson.core:jackson-coreMaven · CVSS 7.5→ 2.21.7
- CVE-2026-89425Denial of service · CVSS 7.5 · >= 2.19.0, <= 2.21.6High
devaluenpm · CVSS 7.5→ 5.9.3
npm install devalue@5.9.3- CVE-2026-92708Information disclosure · CVSS 7.5 · >= 5.1.0, <= 5.9.2High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.