--- title: "Security digest: September 23, 2026" url: https://erroneo.us/security/2026-09-23/ description: "September 23, 2026 vulnerability digest: 3 critical advisories (PyPI, RubyGems, Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-09-23 date_modified: 2026-09-23 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 23, 2026 3 critical advisories. ## Take stock - PyPI: 1 critical advisory ( plone.app.portlets ). Check with pip-audit (or: pip show ) . - RubyGems: 1 critical advisory ( openc3 ). Check with bundle audit check --update . - Maven: 1 critical advisory ( io.moquette:moquette-broker ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-57149](https://erroneo.us/security/cve/CVE-2026-57149/index.md) plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection — PyPI plone.app.portlets >= 7.0.0, <= 7.0.1 → 7.0.2; PyPI plone.app.portlets >= 6.0.0, <= 6.0.3 → 6.0.4; PyPI plone.app.portlets >= 5.0.0, <= 5.0.7 → 5.0.8 - [CVE-2026-77602](https://erroneo.us/security/cve/CVE-2026-77602/index.md) OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) — RubyGems openc3 >= 5.1.0, <= 7.2.1 → 7.3.0 - [CVE-2026-85724](https://erroneo.us/security/cve/CVE-2026-85724/index.md) Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug — Maven io.moquette:moquette-broker <= 0.18.0 → 0.18.1 --- Source page: https://erroneo.us/security/2026-09-23/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt