Security Notices
mppx Security Update Addresses 2 Vulnerabilities
mppx 0.8.2 prevents clients from inflating sponsored Tempo transaction fees through extra calldata or access-list entries. Update the server-side fee payer and review anomalous spending; ordinary caps do not substitute for the fix.
Hatchet Security Update Addresses 4 Vulnerabilities
Hatchet advisories cover an SNS request-forgery path and three cross-tenant task disclosures with authentication and identifier prerequisites. Confirm all four fixes in the supported upgrade path; older-version boundaries remain inconsistent across primary records.
Weblate wlc Security Update Addresses 1 Vulnerability
Weblate wlc can send unscoped API tokens to destinations supplied by untrusted project configuration. Update to 2.0.1, bind credentials to trusted URLs, and assess exposed tokens for revocation; upgrading does not invalidate them.
IBM Concert Software 3.0.1.1 Addresses Multiple Vulnerabilities
IBM Concert Software 1.0.0-3.0.0 requires the 3.0.1.1 update; no workaround is listed. Confirm IBM's deployment-specific instructions because its download wording conflicts, and distinguish a KEV-listed dependency from evidence of Concert compromise.
SIPGO Security Update Addresses 2 Vulnerabilities
SIPGO 1.4.3 combines fixes for unauthenticated memory exhaustion through SIP Content-Length and WebSocket frame lengths. Rebuild affected services with the updated dependency; downstream message limits do not protect allocations made earlier.
deepstream.io Security Update Addresses 1 Vulnerability
deepstream.io 10.1.0 lets authenticated users bypass Valve write rules through PATCH_MULTI. Update affected instances to 10.1.1 and test restricted accounts; switching to permissive permissions would remove protections rather than fix them.
Request Filtering Agent Security Update Addresses 1 Vulnerability
request-filtering-agent can crash Node.js applications while rejecting literal private-IP destinations. Update to 3.2.1 and test rejection handling; the flaw does not establish SSRF access, and disabling destination checks is not a safe workaround.
Dasel Security Update Addresses 2 Vulnerabilities
Dasel 3.11.2 combines fixes for fatal JSON/XML recursion and a selector lexer panic. Update both CLI and embedded-library consumers, rebuilding applications where needed; a document-size cap does not impose a nesting-depth limit.
lwIP Fixes MQTT and API Memory-Corruption Vulnerabilities
lwIP MQTT and API flaws have different network scopes and separate fixes. Identify affected embedded devices and obtain supported firmware containing the applicable commits; updating a source checkout alone does not remediate deployed equipment.