Developer Tools & Supply Chain
AWS Powertools for Lambda Fixes Data-Masking Fail-Open
Amazon Web Services (AWS) issued 2026-123-AWS. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
AWS Updates Amazon Ion Python for Recursion Denial of Service
Amazon Web Services (AWS) issued 2026-122-AWS. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
AWS Kiro IDE 1.0.242 Restricts Agentic Writes from Untrusted Workspaces
Kiro IDE agentic work in an untrusted workspace could modify global configuration outside that workspace. Upgrade to 1.0.242 or later and separately review existing settings, preserving suspicious workspace and filesystem evidence before repair.
Zapros 0.14.0 Bounds Decompression Processing
Zapros 0.14.0 bounds streaming decompression and excessive Content-Encoding chains. Update applications fetching untrusted responses, but retain total-size and processing-time limits; bounded individual chunks do not make unlimited accumulation safe.
Apache BuildStream 2.8.1 Blocks Tar Extraction Escape
BuildStream's tar source plugin can follow malicious archive symlinks outside extraction paths when affected releases run on Python before 3.12. Update build runners with the 2.8.1 fix and verify their actual interpreter and source trust.
MPXJ Security Update Addresses 2 Vulnerabilities
MPXJ fixes separate Merlin file-read and PRX/STX extraction flaws in different releases. Inventory import workers and embedded wrappers, reject untrusted affected formats until updated, and choose a supported release containing both fixes.
mppx Security Update Addresses 2 Vulnerabilities
mppx 0.8.2 prevents clients from inflating sponsored Tempo transaction fees through extra calldata or access-list entries. Update the server-side fee payer and review anomalous spending; ordinary caps do not substitute for the fix.
Weblate wlc Security Update Addresses 1 Vulnerability
Weblate wlc can send unscoped API tokens to destinations supplied by untrusted project configuration. Update to 2.0.1, bind credentials to trusted URLs, and assess exposed tokens for revocation; upgrading does not invalidate them.
Request Filtering Agent Security Update Addresses 1 Vulnerability
request-filtering-agent can crash Node.js applications while rejecting literal private-IP destinations. Update to 3.2.1 and test rejection handling; the flaw does not establish SSRF access, and disabling destination checks is not a safe workaround.
Dasel Security Update Addresses 2 Vulnerabilities
Dasel 3.11.2 combines fixes for fatal JSON/XML recursion and a selector lexer panic. Update both CLI and embedded-library consumers, rebuilding applications where needed; a document-size cap does not impose a nesting-depth limit.