Security Notices
AWS Kiro IDE 1.0.242 Restricts Agentic Writes from Untrusted Workspaces
Kiro IDE agentic work in an untrusted workspace could modify global configuration outside that workspace. Upgrade to 1.0.242 or later and separately review existing settings, preserving suspicious workspace and filesystem evidence before repair.
Eufy Omni C20 and X10 Pro Firmware Update Addresses Three Vulnerabilities
Eufy recommends firmware 1.6.4 or later for affected Omni C20 and X10 Pro models. Check model-specific flaw coverage and confirm running firmware; updating the management app or queuing a download alone is insufficient.
WEBCON BPS Updates Fix Vacation-Data Authorization Bypass
WEBCON BPS can expose other employees' vacation schedules through an authenticated API authorization flaw. Install the branch-appropriate fix and validate cross-team access with synthetic accounts; a login should not authorize every employee's schedule.
Solspace Freeform 5.10.14 Blocks Twig Template Injection
Solspace Freeform 5.10.14 fixes limited Twig injection through public form input in certain response templates. Update through the Craft CMS workflow and test affected forms; the advisory does not demonstrate code execution or secret access.
WPGraphQL 2.22.2 Restores Post Capability Enforcement
WPGraphQL's updatePost mutation can let Contributors publish their own drafts or alter their published posts without required capabilities. Update to 2.22.2 and review post history; successful installation does not prove earlier changes were authorized.
REDAXO 5.21.2 Fixes CSRF and Stored XSS Flaws
REDAXO 5.21.2 fixes stored script injection in media-management paths and missing CSRF protection on addon updates. Back up the site, check addon compatibility, and review backend permissions; the flaws have different access and interaction requirements.
Plug Updates Prevent Parameter-Decoding Denial of Service
Deeply nested request parameters can exhaust CPU during Plug decoding, before normal application handlers run. Update the deployed Plug dependency on its supported branch; replacing only the front-end web server does not fix the parser.
Zapros 0.14.0 Bounds Decompression Processing
Zapros 0.14.0 bounds streaming decompression and excessive Content-Encoding chains. Update applications fetching untrusted responses, but retain total-size and processing-time limits; bounded individual chunks do not make unlimited accumulation safe.
Plone Portlets Updates Fix Critical TALES Injection
Plone Classic portlet configuration can permit authenticated server-side code execution, including through ordinary users' dashboards. Apply the branch-specific package fix and review stored assignments; restricting new portlet creation alone does not neutralize existing malicious content.