Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR

The Monday letter · the tech and security week in one email

Free, every Monday, via Brevo (EU), one-click unsubscribe · your data and rights

Watch ·

Bulletin for Wednesday, October 14, 2026

Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.

+5breaches, in 4 sectors+27advisories, in 17 updates2actively exploited1,500accounts affected, as reported

Deal with these first

Today’s breaches 5

Healthcare2

Industry1

Retail1

Digital services1

Today’s advisories 27

  • Ivanti Connect SecureNetwork · Exploitedvendor patch
  • Microsoft WindowsOS · Exploitedvendor patch
  • Microsoft.Native.Quic.MsQuic.SchannelNuGet · CVSS 9.8→ 2.5.11-ci.159417053
    dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.5.11-ci.159417053
    • CVE-2026-105016Remote code execution · CVSS 9.8 · = 2.5.11-ci.156755675Critical
  • Microsoft.AspNetCore.App.Runtime.linux-armNuGet · CVSS 9.4 · 3 failles→ 8.0.32
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.linux-armNuGet · CVSS 9.1→ 11.0.0-rc.2
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 11.0.0-rc.2
    • CVE-2026-70188Other · CVSS 9.1 · >= 11.0.0-preview.1, <= 11.0.0-rc.1Critical
  • Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet · CVSS 8.8 · 3 failles→ 8.0.32
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 8.0.32
    • CVE-2026-70174Remote code execution · CVSS 8.8 · >= 8.0.0, <= 8.0.31High
    • CVE-2026-85363Remote code execution · CVSS 8.8 · >= 8.0.0, <= 8.0.31High
    • CVE-2026-96235Remote code execution · CVSS 8.8 · >= 8.0.0, <= 8.0.31High
  • Microsoft.AspNetCore.Components.WebAssembly.ServerNuGet · CVSS 8.8 · 2 failles→ 10.0.13
    dotnet add package Microsoft.AspNetCore.Components.WebAssembly.Server --version 10.0.13
    • CVE-2026-102870Remote code execution · CVSS 8.8 · >= 10.0.0, <= 10.0.12High
    • CVE-2026-96230Cross-site scripting · CVSS 8.8 · >= 10.0.0, <= 10.0.12High
  • Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet · CVSS 8.8 · 2 failles→ 9.0.21
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 9.0.21
    • CVE-2026-70007Remote code execution · CVSS 8.8 · >= 9.0.0, <= 9.0.20High
    • CVE-2026-87697Unsafe deserialisation · CVSS 8.8 · >= 9.0.0, <= 9.0.20High
  • Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet · CVSS 8.8 · 2 failles→ 10.0.13
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 10.0.13
    • CVE-2026-70035Unsafe deserialisation · CVSS 8.8 · >= 10.0.0, <= 10.0.12High
    • CVE-2026-96224Remote code execution · CVSS 8.8 · >= 10.0.0, <= 10.0.12High
  • Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet · CVSS 8.8 · 2 failles→ 11.0.0-rc.2
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 11.0.0-rc.2
    • CVE-2026-83520Unsafe deserialisation · CVSS 8.8 · >= 11.0.0-preview.1, <= 11.0.0-rc.1High
    • CVE-2026-96232Information disclosure · CVSS 7.5 · >= 11.0.0-preview.1, <= 11.0.0-rc.1High
  • Microsoft.AspNetCore.App.Runtime.linux-armNuGet · CVSS 8.1→ 9.0.21
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 9.0.21
    • CVE-2026-70175Privilege escalation · CVSS 8.1 · >= 9.0.0, <= 9.0.20High
  • Microsoft.NETCore.App.Runtime.win-arm64NuGet · CVSS 8.1→ 8.0.32
    dotnet add package Microsoft.NETCore.App.Runtime.win-arm64 --version 8.0.32
    • CVE-2026-70197Remote code execution · CVSS 8.1 · >= 8.0.0, <= 8.0.31High
  • Microsoft.NETCore.App.Runtime.linux-armNuGet · CVSS 7.8 · 2 failles→ 8.0.32
    dotnet add package Microsoft.NETCore.App.Runtime.linux-arm --version 8.0.32
  • System.Security.Cryptography.XmlNuGet · CVSS 7.5 · 2 failles→ 10.0.13
    dotnet add package System.Security.Cryptography.Xml --version 10.0.13
    • CVE-2026-96959Denial of service · CVSS 7.5 · >= 10.0.0, <= 10.0.12High
    • CVE-2026-96960Denial of service · CVSS 7.5 · >= 10.0.0, <= 10.0.12High
  • Microsoft.AspNetCore.Authentication.NegotiateNuGet · CVSS 7.5→ 10.0.13
    dotnet add package Microsoft.AspNetCore.Authentication.Negotiate --version 10.0.13
    • CVE-2026-70179Authentication bypass · CVSS 7.5 · >= 10.0.0, <= 10.0.12High
  • Microsoft.NETCore.App.Runtime.linux-armNuGet · CVSS 7.5→ 9.0.21
    dotnet add package Microsoft.NETCore.App.Runtime.linux-arm --version 9.0.21
    • CVE-2026-69651Denial of service · CVSS 7.5 · >= 9.0.0, <= 9.0.20High
  • Microsoft.NETCore.App.Runtime.linux-armNuGet · CVSS 7.5→ 10.0.13
    dotnet add package Microsoft.NETCore.App.Runtime.linux-arm --version 10.0.13
    • CVE-2026-96233Denial of service · CVSS 7.5 · >= 10.0.0, <= 10.0.12High

The week in one email, every Monday

The week’s priorities, breaches, exploited flaws and articles, no ads. For day-by-day, this bulletin’s RSS feed.

One letter a week, on Monday. Your address is only used for this mailing: it is entrusted to Brevo (France, data in the EU), never sold, no advertising. Like any mailing tool, Brevo measures opens and clicks: InYourGeek only reads totals, never per-person statistics. Sign-up confirmed by email; one-click unsubscribe in every letter. Controller: SOULIER Sébastien EI — your data and your rights.

Bulletin RSS feed

An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.