Application Platforms & Middleware
Elastic Kibana Updates Address Authorization, Privilege, and Availability Risks
Kibana advisories cover Agent Builder privileges, Timeline authorization, cross-space Synthetics deletion and resource exhaustion. Match enabled features, roles and release ranges across all four notices before selecting a compatible stack update.
wolfSSL 5.9.4 Fixes Eleven TLS and Certificate Validation Flaws
wolfSSL 5.9.4 fixes TLS and certificate-validation flaws whose applicability depends on build options and APIs. Update embedded and static copies as well as shared libraries, and follow the vendor's persistent-state and cache-handling requirements.
AWS Updates pgcollection to Address Type-Confusion Remote Code Execution
Self-managed pgcollection 2.0.0-2.1.1 needs an update for type-confusion code execution. Inventory installed extensions and plan recovery checks; AWS's unaffected RDS/Aurora statement applies specifically to the pgcollection version named in its bulletin.
Plug Updates Prevent Parameter-Decoding Denial of Service
Deeply nested request parameters can exhaust CPU during Plug decoding, before normal application handlers run. Update the deployed Plug dependency on its supported branch; replacing only the front-end web server does not fix the parser.
Apache Tomcat Native Updates Address Three TLS Flaws
Tomcat Native updates fix handshake crashes, insecure TLS defaults and a client-certificate race. Verify the native library loaded by each JVM; updating Tomcat Java files or system OpenSSL alone does not establish remediation.
Apache Tomcat Updates Address Twelve Security Flaws
Tomcat updates address certificate checks, shared authentication, WebSocket controls and HTTP/AJP resource handling. Update the matching supported branch, including embedded runtimes through their vendor, and migrate unsupported releases rather than assuming their final builds are fixed.
Apache Sling Security Bundle Updates Address Two Filter Bypasses
Apache Sling Security Bundle fixes RefererFilter and ContentDispositionFilter bypasses at different version floors. Choose a supported release containing both fixes and verify the active bundle; stopping at 1.3.2 leaves the later issue unresolved.
Apache Sling XSS 2.4.12 Addresses Five Sanitization and Resource Flaws
Apache Sling XSS 2.4.12 addresses sanitization bypasses and XML resource-limit flaws. Update the deployed XSS bundle itself and review exposed input paths; a Sling platform version alone does not establish remediation.
Apache Doris Updates Address Authentication Bypass and JDBC Code Execution
Apache Doris has separate metadata-authentication and privileged JDBC code-execution flaws. Restrict FE interfaces and driver-management permissions, then choose an upgrade covering both; the 4.0.8 metadata fix alone does not establish JDBC protection.
uniFLOW Online 2026.3 Fixes Legacy UI Session Retention
uniFLOW Online's Legacy UI could retain limited prior-user access during a specific emergency-mode login sequence. NT-ware reports the 2026.3 fix globally deployed; confirm service status rather than attempting a local cloud-service package upgrade.