---
title: "Security digest: October 2, 2026"
url: https://erroneo.us/security/2026-10-02/
description: "October 2, 2026 vulnerability digest: 2 CISA KEV additions (Zammad GmbH); 5 critical advisories (Go, PyPI, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-02
date_modified: 2026-10-02
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 2, 2026

2 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Do you run any of these? Zammad GmbH Zammad. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-05.
- PyPI: 2 critical advisories ( vibe-trading-ai ). Check with pip-audit (or: pip show <package>) .
- npm: 2 critical advisories ( trigger.dev , @a2ui/web_core ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( gitea.com/gitea/runner ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-102490](https://erroneo.us/security/cve/CVE-2026-102490/index.md) Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability (CISA due 2026-10-05)
- [CVE-2026-102489](https://erroneo.us/security/cve/CVE-2026-102489/index.md) Zammad GmbH Zammad: Zammad GmbH Zammad Session Fixation Vulnerability (CISA due 2026-10-05)

## Critical advisories

- [CVE-2026-73802](https://erroneo.us/security/cve/CVE-2026-73802/index.md) gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled — Go gitea.com/gitea/runner < 1.0.9-0.20260731160927-34bfa1915022 → 1.0.9-0.20260731160927-34bfa1915022
- [GHSA-v2f8-6655-7grj](https://erroneo.us/security/ghsa/GHSA-v2f8-6655-7grj/index.md) Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain — PyPI vibe-trading-ai >= 0.1.0, < 0.1.7 → 0.1.7
- [GHSA-jqmf-mx4f-hfr6](https://erroneo.us/security/ghsa/GHSA-jqmf-mx4f-hfr6/index.md) Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF — PyPI vibe-trading-ai >= 0.1.0, < 0.1.7 → 0.1.7
- [GHSA-gg6r-gp4c-89hp](https://erroneo.us/security/ghsa/GHSA-gg6r-gp4c-89hp/index.md) Trigger.dev: V1 coordinator default-secret unauth Socket.IO — npm trigger.dev < 4.5.4 → 4.5.4
- [CVE-2026-10032](https://erroneo.us/security/cve/CVE-2026-10032/index.md) @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions — npm @a2ui/web_core >= 0.9.0, < 0.10.2 → 0.10.2

---
Source page: https://erroneo.us/security/2026-10-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt