Security Notices
Apache Sling XSS 2.4.12 Addresses Five Sanitization and Resource Flaws
Apache Sling XSS 2.4.12 addresses sanitization bypasses and XML resource-limit flaws. Update the deployed XSS bundle itself and review exposed input paths; a Sling platform version alone does not establish remediation.
Apache Doris Updates Address Authentication Bypass and JDBC Code Execution
Apache Doris has separate metadata-authentication and privileged JDBC code-execution flaws. Restrict FE interfaces and driver-management permissions, then choose an upgrade covering both; the 4.0.8 metadata fix alone does not establish JDBC protection.
Changing NHIServiSign Update Fixes OS Command Injection
A malicious web page can induce the identified Linux NHIServiSign client to execute operating-system commands when visited. Update affected signing endpoints to the vendor's fixed release; related Windows and macOS branding does not establish applicability.
Foxit PDF Reader and Editor Updates Address 31 Vulnerabilities
Foxit Reader and Editor updates cover document-processing, updater, path-traversal and signature-validation flaws. Match product, platform and release branch before updating; the thirty-one-CVE set does not mean every issue affects every installation.
uniFLOW Online 2026.3 Fixes Legacy UI Session Retention
uniFLOW Online's Legacy UI could retain limited prior-user access during a specific emergency-mode login sequence. NT-ware reports the 2026.3 fix globally deployed; confirm service status rather than attempting a local cloud-service package upgrade.
Apache BuildStream 2.8.1 Blocks Tar Extraction Escape
BuildStream's tar source plugin can follow malicious archive symlinks outside extraction paths when affected releases run on Python before 3.12. Update build runners with the 2.8.1 fix and verify their actual interpreter and source trust.