---
title: "Security digest: October 6, 2026"
url: https://erroneo.us/security/2026-10-06/
description: "October 6, 2026 vulnerability digest: 6 critical advisories (NuGet, npm, PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-06
date_modified: 2026-10-06
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 6, 2026

6 critical advisories.

## Take stock

- npm: 4 critical advisories ( payload , @payloadcms/plugin-import-export , shell-quote ). Check with npm audit (or: npm ls <package>) .
- NuGet: 1 critical advisory ( Microsoft.Native.Quic.MsQuic.OpenSSL ). Check with dotnet list package --vulnerable --include-transitive .
- PyPI: 1 critical advisory ( langflow ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-105794](https://erroneo.us/security/cve/CVE-2026-105794/index.md) MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL — NuGet Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.20 → 2.4.20; NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0, < 2.5.11 → 2.5.11; NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.6.0, < 2.6.1 → 2.6.1
- [CVE-2026-105851](https://erroneo.us/security/cve/CVE-2026-105851/index.md) Payload: Field access control bypass on auth collections — npm payload > 3.0.0, < 3.90.0 → 3.90.0; npm payload > 4.0.0-canary.0, < 4.0.0-canary.34 → 4.0.0-canary.34
- [CVE-2026-105845](https://erroneo.us/security/cve/CVE-2026-105845/index.md) Payload: SQL Injection in SQLite and Postgres — npm payload >= 3.0.0, < 3.88.0 → 3.88.0; npm payload >= 4.0.0-canary.0, < 4.0.0-canary.27 → 4.0.0-canary.27
- [CVE-2026-105844](https://erroneo.us/security/cve/CVE-2026-105844/index.md) Payload: Prototype pollution in Payload Import Export plugin — npm @payloadcms/plugin-import-export >= 3.0.0, < 3.88.0 → 3.88.0; npm @payloadcms/plugin-import-export >= 4.0.0-canary.0, < 4.0.0-canary.27 → 4.0.0-canary.27
- [CVE-2026-102422](https://erroneo.us/security/cve/CVE-2026-102422/index.md) shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token — npm shell-quote >= 1.8.4, < 1.11.0 → 1.11.0
- [CVE-2026-10561](https://erroneo.us/security/cve/CVE-2026-10561/index.md) Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation — PyPI langflow < 1.10.1 → 1.10.1

---
Source page: https://erroneo.us/security/2026-10-06/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt