GitHub Security Advisory
LightRAG Security Update Addresses 5 Vulnerabilities
LightRAG 1.5.5 addresses API disclosure, plaintext-password timing, login throttling, Markdown-image SSRF and stored WebUI script injection. Update backend and frontend components, then check the actual authentication, ingestion and rate-limit configuration.
Nautobot Security Update Addresses 2 Vulnerabilities
Nautobot fixes stored script injection in form help text and a separate approval-workflow authorization bypass. Match the installed branch, review content-editing and approval permissions, and validate both browser rendering and scheduled-job approval boundaries.
Autobahn Python Security Update Addresses 1 Vulnerability
Autobahn Python and Crossbar can accept expanded WebSocket messages exceeding configured limits when compression is enabled. Update affected dependencies to 26.7.1, redeploy consumers, and validate decompressed-message limits; the demonstrated impact is availability.
Nuclei Security Update Addresses 5 Vulnerabilities
Nuclei 3.10.0 fixes scanner-host code, file-access and conditional environment-disclosure flaws. Update engines and SDK consumers, stop untrusted template execution, and handle potentially exposed credentials separately from the upgrade.
Tinyauth Security Update Addresses 3 Vulnerabilities
Tinyauth advisories cover username timing, mixed-case hostname ACL bypass and global login lockout. Select a supported release containing all fixes, verify the maintained container image source, and preserve a trusted administrative access path.
OpenBao Security Update Addresses 4 Vulnerabilities
OpenBao 2.6.0 addresses Agent log-secret exposure, policy-template privilege expansion, recovery-token timing leakage and a LIST deny-rule bypass. Update servers and Agents separately, restrict exposed logs and assess credential revocation where warranted.
KubeEdge Security Update Addresses 4 Vulnerabilities
KubeEdge fixes job-handler command injection, unsafe installer extraction and authenticated CloudHub memory exhaustion. Inventory cloud, edge and keadm components separately, restrict privileged job access, and stage compatible updates rather than treating all paths as unauthenticated.
MCP Atlassian Security Update Addresses 25 Vulnerabilities
MCP Atlassian's advisory set covers file access, authentication, tool restrictions, SSRF and OAuth handling before 0.22.0. Restrict exposed HTTP/SSE endpoints, upgrade, and assess secret exposure separately; patching does not revoke compromised credentials.
Unleash Security Update Addresses 4 Vulnerabilities
Four Unleash advisories cover approval-email injection and cross-project authorization failures. Upgrade through a supported path containing the 8.0.3 fixes and test project boundaries; two Enterprise-related reports lack runtime confirmation.
Novu Security Update Addresses 1 Vulnerability
Novu's In-App Inbox can execute unsafe notification redirects after a recipient click under the advisory's browser conditions. Update shipped @novu/js bundles to the fixed release and redeploy embedding applications, including wrappers.