Application Platforms & Middleware
Autobahn Python Security Update Addresses 1 Vulnerability
Autobahn Python and Crossbar can accept expanded WebSocket messages exceeding configured limits when compression is enabled. Update affected dependencies to 26.7.1, redeploy consumers, and validate decompressed-message limits; the demonstrated impact is availability.
Unleash Security Update Addresses 4 Vulnerabilities
Four Unleash advisories cover approval-email injection and cross-project authorization failures. Upgrade through a supported path containing the 8.0.3 fixes and test project boundaries; two Enterprise-related reports lack runtime confirmation.
Novu Security Update Addresses 1 Vulnerability
Novu's In-App Inbox can execute unsafe notification redirects after a recipient click under the advisory's browser conditions. Update shipped @novu/js bundles to the fixed release and redeploy embedding applications, including wrappers.
Hatchet Security Update Addresses 4 Vulnerabilities
Hatchet advisories cover an SNS request-forgery path and three cross-tenant task disclosures with authentication and identifier prerequisites. Confirm all four fixes in the supported upgrade path; older-version boundaries remain inconsistent across primary records.
deepstream.io Security Update Addresses 1 Vulnerability
deepstream.io 10.1.0 lets authenticated users bypass Valve write rules through PATCH_MULTI. Update affected instances to 10.1.1 and test restricted accounts; switching to permissive permissions would remove protections rather than fix them.
Adobe AEM Forms on JEE Update Addresses 6 Vulnerabilities
AEM Forms on JEE needs its branch-specific service pack or hotfix for six Critical flaws. A 6.5.25 base installation remains affected without the required hotfix; verify every applicable node.
Adobe Content Credentials SDK Update Addresses 7 Vulnerabilities
Adobe Content Credentials updates address security-feature bypass and denial of service in the Rust SDK and C2PA Tool. Update embedded c2pa dependencies and standalone c2patool separately, rebuilding and redeploying consuming applications where required.
Sync-in Server Updates Fix 2FA, ReDoS, and Login Enumeration Flaws
Sync-in Server 2.4.1 addresses MFA weaknesses, costly sync-filter processing and login-timing enumeration. Update beyond 2.4.0, then check token enforcement, registration lockout and sync behavior with approved accounts.
Erlang/OTP Updates Fix TLS Authentication and Denial-of-Service Flaws
Erlang/OTP fixes affect separate ssl, asn1 and ssh applications. Inventory the runtime actually loaded by each service and update its supported branch; restricting TLS to 1.2 only addresses the TLS authentication issue temporarily.
Apache MINA Corrects an Incomplete Deserialization Fix
MINA's announced deserialization fix missed the 2.0 and 2.1 maintenance branches. Verify the deployed artifact and use the corrected 2.0.31 or 2.1.15 release, reopening remediation records that relied on the earlier fix claim.