CERT Advisory
CERT/CC Reports INFINITT PACS System Manager Code-Execution FlawsNew!!
CERT/CC identifies INFINITT PACS System Manager code-execution flaws. Confirm versions, coordinate supported updates, and validate clinical workflows.
CERT/CC Warns of Three Bisheng Authorization Vulnerabilities
CERT/CC documents three Bisheng authorization flaws, including an unpatched legacy SSO bypass. Upgrade fixed paths, restrict SSO, and retain evidence.
CERT/CC Details BoringSSL Name-Constraint Validation Differences
CERT/CC documents five BoringSSL Name Constraints findings with mixed status. Confirm the validation path, apply available updates, and retain evidence.
CERT/CC Coordinates Name-Constraint Differences Across TLS Libraries
CERT/CC details Name Constraints differences across TLS libraries. Map validation paths, apply project fixes, test authorization, and retain evidence.
Komodo 2.3.0 Fixes Periphery Root Command Injection
Komodo 2.3.0 fixes Critical command injection in Periphery agents. Confirm multi-user grants and exposure, upgrade, review activity, and retain evidence.
CERT/CC Warns of Cross-Tenant Lowcoder Query Access
CERT/CC documents cross-tenant Lowcoder Query Library access without an official fix. Restrict endpoints and roles, isolate tenants, and retain evidence.
CERT/CC Warns of Eleven Vulnerabilities in Thelia 2.6.0 and 2.6.1
CERT/CC VU#162329 documents eleven flaws in Thelia 2.6.0 and 2.6.1 without a patch. Restrict exposure, harden uploads, and retain evidence.
CISA Details ABB PCM600 Scheduler Privilege Risks
CISA's PCM600 notice distinguishes Scheduler privilege escalation from project-archive path traversal. Apply the documented service-account workaround under engineering change control, retain certificate safeguards, and do not mark the underlying defect patched merely because the account changed.
Armatura One Updates Fix Critical Code Execution and Credential Flaws
Armatura One updates address an embedded ActiveMQ code-execution flaw and several credential exposures. Match the standard or USA branch, preserve evidence and assess exposed secrets; known exploitation of ActiveMQ does not prove compromise of a particular installation.
CISA Malcolm Update Addresses Fifteen Security Vulnerabilities
Malcolm updates address fifteen authentication, command, archive and credential-handling issues. Confirm the supported release mapping and explicitly configure KEYCLOAK_SSL_VERIFY; upgrading alone does not enable the added identity-provider certificate check or validate retained sensor coverage.