GitHub Security Advisory
WPGraphQL 2.22.2 Restores Post Capability Enforcement
WPGraphQL's updatePost mutation can let Contributors publish their own drafts or alter their published posts without required capabilities. Update to 2.22.2 and review post history; successful installation does not prove earlier changes were authorized.
REDAXO 5.21.2 Fixes CSRF and Stored XSS Flaws
REDAXO 5.21.2 fixes stored script injection in media-management paths and missing CSRF protection on addon updates. Back up the site, check addon compatibility, and review backend permissions; the flaws have different access and interaction requirements.
Plug Updates Prevent Parameter-Decoding Denial of Service
Deeply nested request parameters can exhaust CPU during Plug decoding, before normal application handlers run. Update the deployed Plug dependency on its supported branch; replacing only the front-end web server does not fix the parser.
Zapros 0.14.0 Bounds Decompression Processing
Zapros 0.14.0 bounds streaming decompression and excessive Content-Encoding chains. Update applications fetching untrusted responses, but retain total-size and processing-time limits; bounded individual chunks do not make unlimited accumulation safe.
Plone Portlets Updates Fix Critical TALES Injection
Plone Classic portlet configuration can permit authenticated server-side code execution, including through ordinary users' dashboards. Apply the branch-specific package fix and review stored assignments; restricting new portlet creation alone does not neutralize existing malicious content.
Home Assistant Security Update Addresses 2 Vulnerabilities
Home Assistant fixes separate IPP-discovery SSRF and Statistics Graph tooltip script injection. Select a supported release containing both Core and frontend fixes, restrict untrusted discovery traffic, and retain configuration backups before updating.
Traefik Security Update Addresses 1 Vulnerability
Traefik BasicAuth timing can reveal whether usernames exist in affected 3.6 and 3.7 releases. Upgrade through a supported path containing 3.7.13; the flaw does not disclose passwords or bypass authentication.
Gardener Security Update Addresses 1 Vulnerability
Gardener project administrators can bypass membership permission checks when changing groups, potentially exposing project secrets. Apply the branch-specific fix and review existing grants; patching alone does not revoke unauthorized memberships or exposed credentials.
Cloudreve Security Update Addresses 3 Vulnerabilities
Cloudreve 4.18.0 addresses upload quota races, read-only admin-token overreach and conditional remote-download SSRF. Update servers, review permissions and monitor storage headroom; the SSRF report does not prove credential theft from a real cloud deployment.
Spree Security Update Addresses 1 Vulnerability
Spree's Store API v3 can let authenticated customers claim another shopper's guest cart and expose stored checkout addresses under the stated conditions. Update the backend branch; replacing the storefront alone does not fix authorization.