Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR

Watch ·

Bulletin for Tuesday, October 6, 2026

Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.

+8breaches, in 6 sectors+25advisories, in 17 updates0actively exploited8.9Maccounts affected, as reported

Deal with these first

  • CVSS 10 · npm

    vm2

    4 failles · fixed in 3.11.8

    npm install vm2@3.11.8

  • Critical

    Nueva EPS

    Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.

  • CVSS 10 · npm

    vm2

    3 failles · fixed in 3.11.7

    npm install vm2@3.11.7

Today’s breaches 8

Public sector3

Healthcare1

Retail1

Nonprofits1

Media and leisure1

Banking and finance1

Today’s advisories 25

  • vm2npm · CVSS 10 · 4 failles→ 3.11.8
    npm install vm2@3.11.8
  • vm2npm · CVSS 10 · 3 failles→ 3.11.7
    npm install vm2@3.11.7
    • CVE-2026-92946Remote code execution · CVSS 10 · <= 3.11.6Critical
    • CVE-2026-92947Information disclosure · CVSS 10 · <= 3.11.6Critical
    • CVE-2026-92956Remote code execution · CVSS 10 · >= 3.10.1, <= 3.11.6Critical
  • vm2npm · CVSS 10 · 2 failles→ 3.12.2
    npm install vm2@3.12.2
  • langflowPyPI · CVSS 9.8→ 1.9.1
    pip install --upgrade "langflow>=1.9.1"
    • CVE-2026-8505Authentication bypass · CVSS 9.8 · >= 1.7.0, <= 1.9.0Critical
  • serovalnpm · CVSS 9.8→ 1.6.2
    npm install seroval@1.6.2
    • CVE-2026-104846Unsafe deserialisation · CVSS 9.8 · >= 0.12.0, <= 1.6.0Critical
  • @capacitor/androidnpm · CVSS 9.3→ 6.2.2
    npm install @capacitor/android@6.2.2
  • langflowPyPI · CVSS 9.1 · 2 failles→ 1.10.1
    pip install --upgrade "langflow>=1.10.1"
  • proxy-addrnpm · CVSS 9.1→ 2.0.8
    npm install proxy-addr@2.0.8
    • CVE-2026-90711Authentication bypass · CVSS 9.1 · >= 1.1.0, < 2.0.8Critical
  • @simple-git/argv-parsernpm · Critical→ 2.0.1
    npm install @simple-git/argv-parser@2.0.1
  • simple-gitnpm · Critical→ 4.0.1
    npm install simple-git@4.0.1
  • tinypoolnpm · Critical→ 2.1.1
    npm install tinypool@2.1.1
  • tinypoolnpm · Critical→ 2.1.2
    npm install tinypool@2.1.2
  • fsspecPyPI · CVSS 8.8→ 2026.6.0
    pip install --upgrade "fsspec>=2026.6.0"
    • CVE-2026-104851Remote code execution · CVSS 8.8 · >= 0.9.0, < 2026.6.0High
  • langflowPyPI · CVSS 8.8→ 1.10.3
    pip install --upgrade "langflow>=1.10.3"
    • CVE-2026-7700Remote code execution · CVSS 8.8 · >= 1.3.0, < 1.10.3High
  • pymongoPyPI · CVSS 8.4→ 4.18.2
    pip install --upgrade "pymongo>=4.18.2"
  • simple-gitnpm · CVSS 8.1 · 2 failles→ 4.0.0
    npm install simple-git@4.0.0
  • @socket.io/cluster-enginenpm · CVSS 7.5→ 0.1.1
    npm install @socket.io/cluster-engine@0.1.1

Get the bulletin every morning

The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.

RSS feed

An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.