Digest · Friday
Security digest: October 9, 2026
4 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 2 critical advisories (
code.vikunja.io/api,github.com/0xJacky/Nginx-UI). Check withgovulncheck ./.... - npm: 1 critical advisory (
tinacms,@tinacms/app). Check withnpm audit (or: npm ls <package>). - Composer (PHP): 1 critical advisory (
contao/comments-bundle). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 2
Check: govulncheck ./...
- Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) CVE-2026-68582 CVSS 9.3 Critical
code.vikunja.io/api>= 0.24.0, <= 2.3.0 → fixed in 2.4.0 - Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite CVE-2026-107806 CVSS 9.0 Critical
github.com/0xJacky/Nginx-UI>= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 → fixed in 1.9.10-0.20260728074146-a467ed652591
Composer (PHP) 1
Check: composer audit
- Contao: Cross-site scripting in the comments bundle CVE-2026-107845 CVSS 9.3 Critical
contao/comments-bundle>= 4.0.0, < 5.3.50 → fixed in 5.3.50;contao/comments-bundle>= 5.4.0-RC1, < 5.7.12 → fixed in 5.7.12
npm 1
Check: npm audit (or: npm ls <package>)
- TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261 CVSS 9.3 Critical
tinacms<= 3.13.0 → fixed in 3.14.0;@tinacms/app<= 2.5.13 → fixed in 2.5.14