Watch ·
Bulletin for Monday, October 5, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
Deal with these first
Exploited · Network
Citrix NetScalerApply the vendor’s patch.
Critical · 53,580 accounts
Fédération belge de taekwondo (Taekwondo.be) et Coachbelgium.beChange that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
Critical · 25,000 accounts
Shinhan BankExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
Today’s breaches 7
Nonprofits1
Banking and finance1
Education1
Retail3
Other1
Today’s advisories 16
Citrix NetScalerNetwork · Exploitedvendor patch
- CVE-2026-88779Denial of serviceCritical
github.com/siyuan-note/siyuan/kernelGo · CVSS 8.2 · 2 failles→ 0.0.0-20260813142806-dd2778b70d02
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260813142806-dd2778b70d02- CVE-2026-82234Server-side request forgery · CVSS 8.2 · < 0.0.0-20260813142806-dd2778b70d02High
- CVE-2026-74904Authentication bypass · CVSS 7.5 · < 0.0.0-20260804015139-bd067a4fe9b2 · → 0.0.0-20260804015139-bd067a4fe9b2High
trigger.devnpm · CVSS 7.7 · 3 failles→ 4.5.2
npm install trigger.dev@4.5.2- CVE-2026-85650Server-side request forgery · CVSS 7.7 · < 4.5.2High
- GHSA-pp95-gc86-jq6qAuthentication bypass · CVSS 7.1 · <= 4.5.1High
- CVE-2026-85651Authentication bypass · CVSS 7.1 · < 4.5.2High
trigger.devnpm · CVSS 7.7 · 2 failles→ 4.5.6
npm install trigger.dev@4.5.6- GHSA-9q4r-4842-93vwInjection · CVSS 7.7 · <= 4.5.5High
- GHSA-pqxw-g93w-hj9xCryptographic weakness · <= 4.5.5High
@fastify/busboynpm · CVSS 7.5 · 2 failles→ 3.2.1
npm install @fastify/busboy@3.2.1- CVE-2026-19481Denial of service · CVSS 7.5 · >= 1.0.0, < 3.2.1High
- CVE-2026-19484Denial of service · CVSS 7.5 · >= 3.1.0, < 3.2.1High
aws-smithy-jsonRust · CVSS 7.5→ 0.62.7
- CVE-2026-18140Unsafe deserialisation · CVSS 7.5 · <= 0.62.6High
praxis-proxyRust · CVSS 7.5→ 0.5.2
- GHSA-cjcg-cxmh-9wcrDenial of service · CVSS 7.5 · < 0.5.2High
probe-image-sizenpm · CVSS 7.5→ 7.4.0
npm install probe-image-size@7.4.0- CVE-2026-104861Denial of service · CVSS 7.5 · <= 7.3.0High
vibe-trading-aiPyPI · CVSS 7.5→ 0.1.7
pip install --upgrade "vibe-trading-ai>=0.1.7"- GHSA-5rmq-chc7-m22fPath traversal · CVSS 7.5 · >= 0.1.0, < 0.1.7High
figletnpm · High→ 1.11.3
npm install figlet@1.11.3- CVE-2026-96780Denial of service · < 1.11.3High
github.com/xtls/xray-coreGo · High→ 1.260327.1-0.20260710210335-64fada32b5b9
go get github.com/xtls/xray-core@v1.260327.1-0.20260710210335-64fada32b5b9- GHSA-5wf9-h793-w73cOther · >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.