Artificial Intelligence & SaaS
MCP Atlassian Security Update Addresses 25 Vulnerabilities
MCP Atlassian's advisory set covers file access, authentication, tool restrictions, SSRF and OAuth handling before 0.22.0. Restrict exposed HTTP/SSE endpoints, upgrade, and assess secret exposure separately; patching does not revoke compromised credentials.
IBM Concert Software 3.0.1.1 Addresses Multiple Vulnerabilities
IBM Concert Software 1.0.0-3.0.0 requires the 3.0.1.1 update; no workaround is listed. Confirm IBM's deployment-specific instructions because its download wording conflicts, and distinguish a KEV-listed dependency from evidence of Concert compromise.
CKAN MCP Server 0.4.108 Addresses an SSRF Validation Bypass
CKAN MCP Server can reach internal services through attacker-controlled DNS names. The advisory lists 0.4.108 as patched; update self-hosted deployments and restrict allowed destinations without treating the version claim as independently tested containment.
NotebookLM MCP 2.0.3 Restricts Vault File Writes
NotebookLM MCP 2.0.3 sanitizes vault filenames, but directory containment remains opt-in. Upgrade affected servers, configure NOTEBOOKLM_VAULT_ROOT in the running process, and restrict its filesystem permissions; updating alone does not contain writes.
NVIDIA NeMo Speech 3.0 Fixes Five Code Execution Flaws
NeMo Speech updates address five vulnerabilities across platforms. Inventory environments and external datasets, model configurations and serialized tokenizer inputs, update the runtime, and redeploy jobs or services still using the old environment.
INCIBE-CERT Reports Fixed 1millionbot Chatbot XSS
The 1millionbot hosted-chatbot fix addresses unsafe Markdown or content blocks in the user's own session. Confirm the provider's managed-service correction and validate approved link rendering; there is no customer package to install.