Watch ·
Bulletin for Friday, October 9, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 5 sectors+30advisories, in 19 updates5actively exploited75,929accounts affected, as reported
Deal with these first
Exploited · Software
Apache StrutsApply the vendor’s patch.
Critical
Association des scouts de FranceExpect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
Exploited · Software
ISC BINDApply the vendor’s patch.
Today’s breaches 10
Retail4
Nonprofits2
Education2
Energy1
Healthcare1
Today’s advisories 30
Apache StrutsSoftware · Exploitedvendor patch
- CVE-2016-3081Remote code executionCritical
ISC BINDSoftware · Exploitedvendor patch
- CVE-2015-5477Denial of serviceCritical
ONLYOFFICE DocsSoftware · Exploitedvendor patch
- CVE-2021-3199Path traversalCritical
ProFTPDSoftware · Exploitedvendor patch
- CVE-2015-3306Authentication bypassCritical
StrapiSoftware · Exploitedvendor patch
- CVE-2023-22894Remote code executionCritical
praisonaiagentsPyPI · CVSS 10 · 5 failles→ 1.6.78
pip install --upgrade "praisonaiagents>=1.6.78"- CVE-2026-61447Remote code execution · CVSS 10 · <= 1.6.77Critical
- CVE-2026-61430Server-side request forgery · CVSS 8.5 · <= 1.6.77High
- CVE-2026-61446Remote code execution · CVSS 8.4 · <= 1.6.77High
- CVE-2026-61443Remote code execution · CVSS 8.1 · <= 1.6.77High
- CVE-2026-61437Supply chain · CVSS 7.8 · <= 1.6.77High
praisonaiPyPI · CVSS 9.9 · 4 failles→ 4.6.78
pip install --upgrade "praisonai>=4.6.78"- CVE-2026-61445Remote code execution · CVSS 9.9 · <= 4.6.77Critical
- CVE-2026-61434Remote code execution · CVSS 8.8 · <= 4.6.77High
- CVE-2026-61435Authentication bypass · CVSS 8.2 · <= 4.6.77High
- CVE-2026-61433Remote code execution · CVSS 7.8 · <= 4.6.77High
fast-jwtnpm · CVSS 9.8 · 2 failles→ 6.3.0
npm install fast-jwt@6.3.0- CVE-2026-107722Cryptographic weakness · CVSS 9.8 · >= 6.2.0, <= 6.2.4Critical
- CVE-2026-107723Other · CVSS 8.1 · <= 6.2.4High
handlebarsnpm · CVSS 9.8 · 2 failles→ 4.7.10
npm install handlebars@4.7.10- CVE-2026-106446Remote code execution · CVSS 9.8 · >= 4.0.0, <= 4.7.9Critical
- CVE-2026-106445Remote code execution · >= 4.0.0, <= 4.7.9Critical
com.hazelcast:hazelcastMaven · Critical→ 5.7.0
- CVE-2026-107726Remote code execution · = 5.6.0Critical
org.asynchttpclient:async-http-clientMaven · Critical→ 3.0.13
- CVE-2026-107282Authentication bypass · >= 3.0.0, <= 3.0.12Critical
generator-jhipsternpm · CVSS 8.8 · 2 failles→ 9.4.0
npm install generator-jhipster@9.4.0- CVE-2026-107375Injection · CVSS 8.8 · >= 7.0.0, < 9.4.0High
- CVE-2026-107303Cross-site scripting · CVSS 7.6 · < 9.4.0High
praisonainpm · CVSS 8.6→ 1.7.3
npm install praisonai@1.7.3- CVE-2026-61426Authentication bypass · CVSS 8.6 · < 1.7.3High
mariadbnpm · CVSS 8.1 · 2 failles→ 3.2.5
npm install mariadb@3.2.5- CVE-2026-107384Injection · CVSS 8.1 · >= 3.2.0, < 3.2.5High
- CVE-2026-107383Information disclosure · CVSS 7.5 · < 3.2.5High
pydantic-aiPyPI · CVSS 7.6→ 1.107.4
pip install --upgrade "pydantic-ai>=1.107.4"- CVE-2026-107295Other · CVSS 7.6 · >= 1.34.0, < 1.107.4High
datamodel-code-generatorPyPI · CVSS 7.5→ 0.81.0
pip install --upgrade "datamodel-code-generator>=0.81.0"- CVE-2026-107377Path traversal · CVSS 7.5 · >= 0.59.0, <= 0.80.0High
github.com/corazawaf/coraza/v3Go · CVSS 7.5→ 3.8.1
go get github.com/corazawaf/coraza/v3@v3.8.1- CVE-2026-107826Other · CVSS 7.5 · >= 3.0.0, < 3.8.1High
msgpack5npm · CVSS 7.5→ 6.1.0
npm install msgpack5@6.1.0- CVE-2026-107302Other · CVSS 7.5 · < 6.1.0High
pydantic-aiPyPI · CVSS 7.5→ 2.53.0
pip install --upgrade "pydantic-ai>=2.53.0"- CVE-2026-107286Other · CVSS 7.5 · >= 2.10.0, < 2.53.0High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.