Digest · Tuesday

Security digest: October 6, 2026

6 critical advisories.

Take stock

npm: 4 critical advisories (payload, @payloadcms/plugin-import-export, shell-quote). Check with npm audit (or: npm ls <package>).
NuGet: 1 critical advisory (Microsoft.Native.Quic.MsQuic.OpenSSL). Check with dotnet list package --vulnerable --include-transitive.
PyPI: 1 critical advisory (langflow). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: npm audit (or: npm ls <package>)

Payload: Field access control bypass on auth collections CVE-2026-105851 CVSS 9.3 Critical
payload > 3.0.0, < 3.90.0 → fixed in 3.90.0; payload > 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34
Payload: SQL Injection in SQLite and Postgres CVE-2026-105845 CVSS 9.8 Critical
payload >= 3.0.0, < 3.88.0 → fixed in 3.88.0; payload >= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27
Payload: Prototype pollution in Payload Import Export plugin CVE-2026-105844 CVSS 9.3 Critical
@payloadcms/plugin-import-export >= 3.0.0, < 3.88.0 → fixed in 3.88.0; @payloadcms/plugin-import-export >= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token CVE-2026-102422 CVSS 9.2 Critical
shell-quote >= 1.8.4, < 1.11.0 → fixed in 1.11.0

Check: dotnet list package --vulnerable --include-transitive

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL CVE-2026-105794 CVSS 9.1 Critical
Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.20 → fixed in 2.4.20; Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0, < 2.5.11 → fixed in 2.5.11; Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.6.0, < 2.6.1 → fixed in 2.6.1

Check: pip-audit (or: pip show <package>)

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation CVE-2026-10561 CVSS 9.9 Critical
langflow < 1.10.1 → fixed in 1.10.1