Watch ·
Bulletin for Thursday, October 8, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 6 sectors+25advisories, in 18 updates0actively exploited648,382accounts affected, as reported
Deal with these first
CVSS 10 · npm
@payloadcms/plugin-form-builderFixed in 3.90.0
npm install @payloadcms/plugin-form-builder@3.90.0Critical
France Pare-BriseExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
CVSS 10 · npm
vm2Fixed in 3.12.1
npm install vm2@3.12.1
Today’s breaches 10
Transport and travel1
Other1
Retail4
Digital services2
Healthcare1
Employment and HR1
Today’s advisories 25
@payloadcms/plugin-form-buildernpm · CVSS 10→ 3.90.0
npm install @payloadcms/plugin-form-builder@3.90.0- CVE-2026-105857Remote code execution · CVSS 10 · < 3.90.0Critical
vm2npm · CVSS 10→ 3.12.1
npm install vm2@3.12.1- CVE-2026-93605Remote code execution · CVSS 10 · <= 3.12.0Critical
langflowPyPI · CVSS 9.9→ 1.10.3
pip install --upgrade "langflow>=1.10.3"- CVE-2026-105697Remote code execution · CVSS 9.9 · >= 1.1.2, < 1.10.3Critical
payloadnpm · CVSS 9.8 · 5 failles→ 3.90.0
npm install payload@3.90.0- CVE-2026-105859Authentication bypass · CVSS 9.8 · < 3.90.0Critical
- CVE-2026-105863Authentication bypass · >= 3.0.0, < 3.90.0Critical
- CVE-2026-105862Cross-site scripting · CVSS 8.7 · < 3.90.0High
- CVE-2026-105858Remote code execution · CVSS 8.1 · < 3.90.0High
- CVE-2026-105865Path traversal · CVSS 8.1 · < 3.90.0High
@backstage/plugin-techdocs-nodenpm · CVSS 8.8 · 2 failles→ 1.15.4
npm install @backstage/plugin-techdocs-node@1.15.4- CVE-2026-106558Unsafe deserialisation · CVSS 8.8 · < 1.15.4High
- CVE-2026-106510Remote code execution · CVSS 7.7 · < 1.15.4High
ghostnpm · CVSS 8.8→ 6.67.0
npm install ghost@6.67.0- CVE-2026-105642Remote code execution · CVSS 8.8 · >= 6.56.0, < 6.67.0High
WeasyPrintPyPI · CVSS 8.8→ 70.0
pip install --upgrade "WeasyPrint>=70.0"- CVE-2026-106443Remote code execution · CVSS 8.8 · <= 69.0High
@backstage/plugin-scaffolder-backend-module-bitbucket-cloudnpm · CVSS 8.5→ 0.3.10
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.3.10- CVE-2026-106486Path traversal · CVSS 8.5 · < 0.3.10High
@backstage/plugin-scaffolder-backend-module-sentrynpm · CVSS 8.5→ 0.3.8
npm install @backstage/plugin-scaffolder-backend-module-sentry@0.3.8- CVE-2026-106459Server-side request forgery · CVSS 8.5 · >= 0.3.0, < 0.3.8High
praisonaiagentsPyPI · CVSS 8.5→ 1.6.78
pip install --upgrade "praisonaiagents>=1.6.78"- CVE-2026-61429Server-side request forgery · CVSS 8.5 · <= 1.6.77High
ghostnpm · CVSS 8.1 · 2 failles→ 6.64.0
npm install ghost@6.64.0- CVE-2026-105650Cross-site scripting · CVSS 8.1 · >= 2.5.0, < 6.64.0High
- CVE-2026-105675Injection · CVSS 7.5 · >= 4.39.0, < 6.64.0High
@backstage/plugin-auth-backend-module-oidc-providernpm · CVSS 8.1→ 0.4.20
npm install @backstage/plugin-auth-backend-module-oidc-provider@0.4.20- CVE-2026-106488Authentication bypass · CVSS 8.1 · < 0.4.20High
hydra-corePyPI · CVSS 7.8 · 2 failles→ 1.3.6
pip install --upgrade "hydra-core>=1.3.6"- CVE-2026-106441Remote code execution · CVSS 7.8 · < 1.3.6High
- CVE-2026-106442Unsafe deserialisation · CVSS 7.8 · >= 1.3.4, < 1.3.6High
hydra-optuna-sweeperPyPI · CVSS 7.8→ 1.3.0
pip install --upgrade "hydra-optuna-sweeper>=1.3.0"- CVE-2026-106440Remote code execution · CVSS 7.8 · >= 1.2.0, < 1.3.0High
@backstage/plugin-techdocs-nodenpm · CVSS 7.7→ 1.14.7
npm install @backstage/plugin-techdocs-node@1.14.7- CVE-2026-106455Server-side request forgery · CVSS 7.7 · >= 0.11.12, < 1.14.7High
@backstage/backend-defaultsnpm · CVSS 7.6→ 0.17.8
npm install @backstage/backend-defaults@0.17.8- CVE-2026-106492Authentication bypass · CVSS 7.6 · < 0.17.8High
doclingPyPI · CVSS 7.5→ 2.132.0
pip install --upgrade "docling>=2.132.0"- CVE-2026-105744Path traversal · CVSS 7.5 · >= 2.94.0, < 2.132.0High
PraisonAIPyPI · CVSS 7.5→ 4.6.78
pip install --upgrade "PraisonAI>=4.6.78"- CVE-2026-61439Other · CVSS 7.5 · <= 4.6.77High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.