Digest · Wednesday
Security digest: September 23, 2026
3 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 1 critical advisory (
plone.app.portlets). Check withpip-audit (or: pip show <package>). - RubyGems: 1 critical advisory (
openc3). Check withbundle audit check --update. - Maven: 1 critical advisory (
io.moquette:moquette-broker). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message… CVE-2026-85724 CVSS 9.6 Critical
io.moquette:moquette-broker<= 0.18.0 → fixed in 0.18.1
PyPI 1
Check: pip-audit (or: pip show <package>)
- plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection CVE-2026-57149 CVSS 9.9 Critical
plone.app.portlets>= 7.0.0, <= 7.0.1 → fixed in 7.0.2;plone.app.portlets>= 6.0.0, <= 6.0.3 → fixed in 6.0.4;plone.app.portlets>= 5.0.0, <= 5.0.7 → fixed in 5.0.8
RubyGems 1
Check: bundle audit check --update
- OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and… CVE-2026-77602 CVSS 9.9 Critical
openc3>= 5.1.0, <= 7.2.1 → fixed in 7.3.0