Security Notices
Tinyauth Security Update Addresses 3 Vulnerabilities
Tinyauth advisories cover username timing, mixed-case hostname ACL bypass and global login lockout. Select a supported release containing all fixes, verify the maintained container image source, and preserve a trusted administrative access path.
OpenBao Security Update Addresses 4 Vulnerabilities
OpenBao 2.6.0 addresses Agent log-secret exposure, policy-template privilege expansion, recovery-token timing leakage and a LIST deny-rule bypass. Update servers and Agents separately, restrict exposed logs and assess credential revocation where warranted.
KubeEdge Security Update Addresses 4 Vulnerabilities
KubeEdge fixes job-handler command injection, unsafe installer extraction and authenticated CloudHub memory exhaustion. Inventory cloud, edge and keadm components separately, restrict privileged job access, and stage compatible updates rather than treating all paths as unauthenticated.
MCP Atlassian Security Update Addresses 25 Vulnerabilities
MCP Atlassian's advisory set covers file access, authentication, tool restrictions, SSRF and OAuth handling before 0.22.0. Restrict exposed HTTP/SSE endpoints, upgrade, and assess secret exposure separately; patching does not revoke compromised credentials.
Unleash Security Update Addresses 4 Vulnerabilities
Four Unleash advisories cover approval-email injection and cross-project authorization failures. Upgrade through a supported path containing the 8.0.3 fixes and test project boundaries; two Enterprise-related reports lack runtime confirmation.
Novu Security Update Addresses 1 Vulnerability
Novu's In-App Inbox can execute unsafe notification redirects after a recipient click under the advisory's browser conditions. Update shipped @novu/js bundles to the fixed release and redeploy embedding applications, including wrappers.
Graylog Security Update Addresses 1 Vulnerability
Graylog editors can improperly transfer ownership of saved searches or dashboards, enabling deletion or loss of access. Update self-managed branches and test object permissions; Graylog reports its Cloud service already patched.
MPXJ Security Update Addresses 2 Vulnerabilities
MPXJ fixes separate Merlin file-read and PRX/STX extraction flaws in different releases. Inventory import workers and embedded wrappers, reject untrusted affected formats until updated, and choose a supported release containing both fixes.
Fabio Security Update Addresses 1 Vulnerability
Fabio 1.6.6-1.7.1 can strip configured client-IP, TLS or request-ID headers before backend delivery. Update to 1.7.2 and review controls relying on those headers; impact depends on downstream behavior, not a universal authentication bypass.
Mattermost Updates Fix OAuth SSRF and Plugin Route Denial of Service
Mattermost updates address administrator-controlled OAuth SSRF and authenticated plugin-request memory exhaustion. Match the fix to each server's release branch, update the cluster, and validate sign-in and plugin workflows; neither flaw is described as unauthenticated.