Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR

Watch ·

Bulletin for Saturday, October 10, 2026

Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.

+9breaches, in 5 sectors+18advisories, in 9 updates0actively exploited23Maccounts affected, as reported

Deal with these first

  • CVSS 9.3 · Composer

    contao/comments-bundle

    Fixed in 5.3.50

    composer require "contao/comments-bundle:>=5.3.50"

  • Critical

    Ministère de l'Éducation nationale

    Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.

  • CVSS 9.3 · npm

    tinacms

    Fixed in 3.14.0

    npm install tinacms@3.14.0

Today’s breaches 9

Digital services3

Education2

Retail2

Nonprofits1

Public sector1

Today’s advisories 18

  • contao/comments-bundleComposer · CVSS 9.3→ 5.3.50
    composer require "contao/comments-bundle:>=5.3.50"
    • CVE-2026-107845Cross-site scripting · CVSS 9.3 · >= 4.0.0, < 5.3.50Critical
  • tinacmsnpm · CVSS 9.3→ 3.14.0
    npm install tinacms@3.14.0
  • github.com/0xJacky/Nginx-UIGo · CVSS 8.8 · 7 failles→ 1.9.10-0.20260728091109-0ecbd106c37b
    go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728091109-0ecbd106c37b
    • CVE-2026-107806Remote code execution · >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 · → 1.9.10-0.20260728074146-a467ed652591Critical
    • CVE-2026-107807Authentication bypass · CVSS 8.8 · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b · → 1.9.10-0.20260728074433-a3999bd78a3bHigh
    • CVE-2026-107809Other · CVSS 8.8 · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b · → 1.9.10-0.20260728074433-a3999bd78a3bHigh
    • CVE-2026-107811Authentication bypass · CVSS 8.8 · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37bHigh
    • CVE-2026-107813Authentication bypass · CVSS 8.8 · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b · → 1.9.10-0.20260728074433-a3999bd78a3bHigh
    • CVE-2026-107808Authentication bypass · CVSS 8.1 · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814 · → 1.9.10-0.20260728074558-95cd21b70814High
    • CVE-2026-107810Path traversal · CVSS 8.1 · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591 · → 1.9.10-0.20260728074146-a467ed652591High
  • code.vikunja.io/apiGo · CVSS 8.1 · 4 failles→ 2.4.0
    go get code.vikunja.io/api@v2.4.0
  • github.com/argoproj/argo-cd/v2Go · CVSS 8.8vendor patch
    • CVE-2026-55797Remote code execution · CVSS 8.8 · >= 2.11.0, <= 2.14.21High
  • @tinacms/clinpm · CVSS 8.2→ 3.0.0
    npm install @tinacms/cli@3.0.0
  • pyload-ngPyPI · CVSS 8.1vendor patch
  • pyload-ngPyPI · CVSS 8.1→ 0.5.0b3.dev101
    pip install --upgrade "pyload-ng>=0.5.0b3.dev101"
  • @tinacms/web-componentsnpm · CVSS 7.6→ 0.2.1
    npm install @tinacms/web-components@0.2.1

Get the bulletin every morning

The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.

RSS feed

An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.