---
title: "Security digest: October 9, 2026"
url: https://erroneo.us/security/2026-10-09/
description: "October 9, 2026 vulnerability digest: 4 critical advisories (npm, Go, Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-09
date_modified: 2026-10-09
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 9, 2026

4 critical advisories.

## Take stock

- Go: 2 critical advisories ( code.vikunja.io/api , github.com/0xJacky/Nginx-UI ). Check with govulncheck ./... .
- npm: 1 critical advisory ( tinacms , @tinacms/app ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( contao/comments-bundle ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-108261](https://erroneo.us/security/cve/CVE-2026-108261/index.md) TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment — npm tinacms <= 3.13.0 → 3.14.0; npm @tinacms/app <= 2.5.13 → 2.5.14
- [CVE-2026-68582](https://erroneo.us/security/cve/CVE-2026-68582/index.md) Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) — Go code.vikunja.io/api >= 0.24.0, <= 2.3.0 → 2.4.0
- [CVE-2026-107806](https://erroneo.us/security/cve/CVE-2026-107806/index.md) Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite — Go github.com/0xJacky/Nginx-UI >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 → 1.9.10-0.20260728074146-a467ed652591
- [CVE-2026-107845](https://erroneo.us/security/cve/CVE-2026-107845/index.md) Contao: Cross-site scripting in the comments bundle — Composer (PHP) contao/comments-bundle >= 4.0.0, < 5.3.50 → 5.3.50; Composer (PHP) contao/comments-bundle >= 5.4.0-RC1, < 5.7.12 → 5.7.12

---
Source page: https://erroneo.us/security/2026-10-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt