GitHub Security Advisory
Graylog Security Update Addresses 1 Vulnerability
Graylog editors can improperly transfer ownership of saved searches or dashboards, enabling deletion or loss of access. Update self-managed branches and test object permissions; Graylog reports its Cloud service already patched.
MPXJ Security Update Addresses 2 Vulnerabilities
MPXJ fixes separate Merlin file-read and PRX/STX extraction flaws in different releases. Inventory import workers and embedded wrappers, reject untrusted affected formats until updated, and choose a supported release containing both fixes.
Fabio Security Update Addresses 1 Vulnerability
Fabio 1.6.6-1.7.1 can strip configured client-IP, TLS or request-ID headers before backend delivery. Update to 1.7.2 and review controls relying on those headers; impact depends on downstream behavior, not a universal authentication bypass.
mppx Security Update Addresses 2 Vulnerabilities
mppx 0.8.2 prevents clients from inflating sponsored Tempo transaction fees through extra calldata or access-list entries. Update the server-side fee payer and review anomalous spending; ordinary caps do not substitute for the fix.
Hatchet Security Update Addresses 4 Vulnerabilities
Hatchet advisories cover an SNS request-forgery path and three cross-tenant task disclosures with authentication and identifier prerequisites. Confirm all four fixes in the supported upgrade path; older-version boundaries remain inconsistent across primary records.
Weblate wlc Security Update Addresses 1 Vulnerability
Weblate wlc can send unscoped API tokens to destinations supplied by untrusted project configuration. Update to 2.0.1, bind credentials to trusted URLs, and assess exposed tokens for revocation; upgrading does not invalidate them.
SIPGO Security Update Addresses 2 Vulnerabilities
SIPGO 1.4.3 combines fixes for unauthenticated memory exhaustion through SIP Content-Length and WebSocket frame lengths. Rebuild affected services with the updated dependency; downstream message limits do not protect allocations made earlier.
deepstream.io Security Update Addresses 1 Vulnerability
deepstream.io 10.1.0 lets authenticated users bypass Valve write rules through PATCH_MULTI. Update affected instances to 10.1.1 and test restricted accounts; switching to permissive permissions would remove protections rather than fix them.
Request Filtering Agent Security Update Addresses 1 Vulnerability
request-filtering-agent can crash Node.js applications while rejecting literal private-IP destinations. Update to 3.2.1 and test rejection handling; the flaw does not establish SSRF access, and disabling destination checks is not a safe workaround.
Dasel Security Update Addresses 2 Vulnerabilities
Dasel 3.11.2 combines fixes for fatal JSON/XML recursion and a selector lexer panic. Update both CLI and embedded-library consumers, rebuilding applications where needed; a document-size cap does not impose a nesting-depth limit.