Watch ·
Bulletin for Wednesday, October 7, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+9breaches, in 4 sectors+9advisories, in 9 updates0actively exploited7.1Maccounts affected, as reported
Deal with these first
CVSS 9.9 · PyPI
langflowFixed in 1.10.1
pip install --upgrade "langflow>=1.10.1"Critical · 6.8M accounts
Angel OneExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
CVSS 9.8 · npm
payloadFixed in 3.88.0
npm install payload@3.88.0
Today’s breaches 9
Retail6
- Armurerie DouilletID document · banking · address · birth date—Reported
- Armurerie Douillet-DreumontID document · banking · address · birth date—Reported
- Hespérideaddress · name · email · phone7,700Reported
- ASOSname · other—Confirmed
- Bati-Avenuename · phone—Reported
- Gefradisaddress · name · email · phone—Reported
Banking and finance1
Public sector1
Digital services1
Today’s advisories 9
langflowPyPI · CVSS 9.9→ 1.10.1
pip install --upgrade "langflow>=1.10.1"- CVE-2026-10561Remote code execution · CVSS 9.9 · < 1.10.1Critical
payloadnpm · CVSS 9.8→ 3.88.0
npm install payload@3.88.0- CVE-2026-105845Injection · CVSS 9.8 · >= 3.0.0, < 3.88.0Critical
@payloadcms/plugin-import-exportnpm · Critical→ 3.88.0
npm install @payloadcms/plugin-import-export@3.88.0- CVE-2026-105844Remote code execution · >= 3.0.0, < 3.88.0Critical
Microsoft.Native.Quic.MsQuic.OpenSSLNuGet · Critical→ 2.4.20
dotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.4.20- CVE-2026-105794Other · < 2.4.20Critical
payloadnpm · Critical→ 3.90.0
npm install payload@3.90.0- CVE-2026-105851Authentication bypass · > 3.0.0, < 3.90.0Critical
Microsoft.OpenApi.KiotaNuGet · CVSS 8.8→ 1.35.0
dotnet add package Microsoft.OpenApi.Kiota --version 1.35.0- CVE-2026-105796Remote code execution · CVSS 8.8 · >= 0.5.0, < 1.35.0High
shell-quotenpm · CVSS 8.1→ 1.11.0
npm install shell-quote@1.11.0- CVE-2026-102422Remote code execution · CVSS 8.1 · >= 1.8.4, < 1.11.0High
knownsnpm · CVSS 7.8→ 0.30.0
npm install knowns@0.30.0- CVE-2026-86540Remote code execution · CVSS 7.8 · <= 0.29.1High
@modelcontextprotocol/sdknpm · CVSS 7.5→ 1.31.0
npm install @modelcontextprotocol/sdk@1.31.0- CVE-2026-104850Authentication bypass · CVSS 7.5 · >= 1.12.0, < 1.31.0High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.