Application Platforms & Middleware
Node.js Security Releases Fix Ten Runtime Vulnerabilities
Node.js 22.23.4, 24.22.1, and 26.12.1 fix ten vulnerabilities. Update supported lines, rebuild derived artifacts, validate, and retain evidence.
CISA Adds Actively Exploited Plex Media Server Chain to KEV
CISA added four actively exploited Plex Media Server flaws to KEV. Update now, assess exposed servers for compromise, and retain evidence.
CERT/CC Warns of Cross-Tenant Lowcoder Query Access
CERT/CC documents cross-tenant Lowcoder Query Library access without an official fix. Restrict endpoints and roles, isolate tenants, and retain evidence.
OTRS 2026.7.1 Addresses Nine Security Vulnerabilities
OTRS 2026.7.1 fixes nine security issues, including critical authentication risks. Confirm edition scope, update, validate controls, and retain evidence.
Dassault Systèmes Publishes Six Tuleap Enterprise Security Advisories
Dassault Systèmes disclosed six High-severity Tuleap flaws. Confirm 17.0–17.5 exposure, obtain supported remediation, test, and retain evidence.
Decimal 3.1.2 Fixes Unbounded Rounding Allocation
Decimal 3.1.2 fixes an unbounded rounding allocation flaw. Find user-controlled places values, upgrade, validate behavior, and retain evidence.
Apache DataSketches C++ 5.3.0 Hardens Five Deserialization Paths
Apache DataSketches C++ 5.3.0 fixes five deserialization flaws. Find untrusted sketch inputs, upgrade, validate consumers, and retain evidence.
CISA Adds Apache Struts Command Injection to KEV
Apache issued CISA KEV: CVE-2016-3081 for Apache Struts. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
Django 6.1.2, 6.0.9, and 5.2.18 Fix Four Security Issues
Django released 6.1.2, 6.0.9, and 5.2.18 for four security issues. Inventory applications, update the active branch, test behavior, and retain evidence.
Elastic Updates Elasticsearch for Seven Resource-Consumption Flaws
Seven Elasticsearch advisories address service-disrupting resource consumption with different affected ranges and fixes. Check all applicable notices and supported cluster upgrade order; access restrictions reduce exposure but are not equivalent to vendor fixes.