Collaboration & Communications
Mattermost Updates Fix Agents Plugin Replacement Flaw
Mattermost updates fix an Agents plugin path traversal leading to plugin replacement and code execution. Update, validate, and retain evidence.
Postiz 2.25.3 Fixes File Read and Token Forgery Flaws
Postiz 2.25.3 fixes arbitrary file read and token forgery. Upgrade promptly, preserve relevant evidence, validate access, and retain change proof.
Postiz 2.25.2 Fixes Provider-Method File Read and Crash
Postiz 2.25.2 fixes internal provider-method abuse that can read server files or crash the backend. Preserve evidence, upgrade, validate, and retain proof.
CISA Adds Exploited Collabora Built-in CODE Flaw to KEV
CISA added exploited Collabora Built-in CODE CVE-2026-110447 to KEV. Preserve evidence, update or remove the app, triage, and validate.
hMailServer 6.3.4 Fixes Pre-Authentication Script Injection
hMailServer 6.3.4 fixes script-injection paths with specific event and rule conditions. Plan manual installation and tested database/mail-data recovery; live update will not install this release, and a binary downgrade cannot reverse its database migration.
Mattermost Updates Fix OAuth SSRF and Plugin Route Denial of Service
Mattermost updates address administrator-controlled OAuth SSRF and authenticated plugin-request memory exhaustion. Match the fix to each server's release branch, update the cluster, and validate sign-in and plugin workflows; neither flaw is described as unauthenticated.
SIPGO Security Update Addresses 2 Vulnerabilities
SIPGO 1.4.3 combines fixes for unauthenticated memory exhaustion through SIP Content-Length and WebSocket frame lengths. Rebuild affected services with the updated dependency; downstream message limits do not protect allocations made earlier.
Adobe Connect Update Addresses 9 Vulnerabilities
Adobe Connect and its Android app require separate updates for flaws including code execution, file reads and privilege escalation. Inventory both the deployment and client fleet; authentication and interaction requirements differ across the nine issues.
Mattermost Updates Bound Bulk Reactions Requests
An authenticated Mattermost user can submit an unbounded bulk-reactions post-ID array and overload the database. Update the installed maintenance stream, prepare database recovery, and verify every application node leaves the affected range.