Watch ·
Bulletin for Saturday, October 3, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+9breaches, in 4 sectors+12advisories, in 9 updates2actively exploited64,526accounts affected, as reported
Deal with these first
Exploited · Software
Zammad GmbH ZammadApply the vendor’s patch.
Exploited · Software
Zammad GmbH ZammadApply the vendor’s patch.
CVSS 10 · PyPI
vibe-trading-ai2 failles · fixed in 0.1.7
pip install --upgrade "vibe-trading-ai>=0.1.7"
Today’s breaches 9
Nonprofits4
- Equibel (Fédération Royale Belge des Sports Équestres)address · birth date · name · email55,846Reported
- Fédération royale belge de football (RBFA/URBSFA)birth date · address · name · work data—Reported
- Fédération Royale Colombophile Belge (KBDB/RFCB)address · name · other · ID8,680Reported
- CAPEB (Confédération de l'artisanat et des petites entreprises du bâtiment)address · name · email · phone—Reported
Retail3
Education1
Public sector1
Today’s advisories 12
Zammad GmbH ZammadSoftware · Exploitedvendor patch
- CVE-2026-102489Remote code executionCritical
Zammad GmbH ZammadSoftware · Exploitedvendor patch
- CVE-2026-102490Privilege escalationCritical
vibe-trading-aiPyPI · CVSS 10 · 2 failles→ 0.1.7
pip install --upgrade "vibe-trading-ai>=0.1.7"- GHSA-jqmf-mx4f-hfr6Remote code execution · CVSS 10 · >= 0.1.0, < 0.1.7Critical
- GHSA-v2f8-6655-7grjAuthentication bypass · CVSS 10 · >= 0.1.0, < 0.1.7Critical
gitea.com/gitea/runnerGo · CVSS 9.9→ 1.0.9-0.20260731160927-34bfa1915022
go get gitea.com/gitea/runner@v1.0.9-0.20260731160927-34bfa1915022- CVE-2026-73802Privilege escalation · CVSS 9.9 · < 1.0.9-0.20260731160927-34bfa1915022Critical
@a2ui/web_corenpm · CVSS 9.3→ 0.10.2
npm install @a2ui/web_core@0.10.2- CVE-2026-10032Cross-site scripting · CVSS 9.3 · >= 0.9.0, < 0.10.2Critical
trigger.devnpm · Critical→ 4.5.4
npm install trigger.dev@4.5.4- GHSA-gg6r-gp4c-89hpAuthentication bypass · < 4.5.4Critical
dulwichPyPI · CVSS 8.8→ 1.2.9
pip install --upgrade "dulwich>=1.2.9"- GHSA-8mcx-5rqc-vhmfPath traversal · CVSS 8.8 · < 1.2.9High
headroom-aiPyPI · CVSS 8.8→ 0.35.0
pip install --upgrade "headroom-ai>=0.35.0"- CVE-2026-71416Authentication bypass · CVSS 8.8 · < 0.35.0High
dulwichPyPI · CVSS 8.6 · 3 failles→ 1.2.8
pip install --upgrade "dulwich>=1.2.8"- GHSA-5fqc-mrg8-w798Path traversal · CVSS 8.6 · >= 0.23.1, <= 1.2.7High
- GHSA-8w8g-wq8h-fq33Path traversal · CVSS 8.6 · >= 0.24.0, <= 1.2.7High
- GHSA-cm62-gvxx-vmxxPath traversal · CVSS 8.6 · >= 0.22.5, <= 1.2.7High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.