GitHub Security Advisory
OpenCVE Security Update Addresses 1 Vulnerability
OpenCVE notification testing can let authorized users send server-side requests to internal services. Upgrade to 3.0.0 or later, review notification permissions and restrict egress while planning the supported major-version migration.
psd-tools Security Update Addresses 1 Vulnerability
psd-tools can exhaust worker memory from attacker-controlled PSD dimensions before validation. Update deployed Python workers to 1.17.4 and retain memory controls; file-byte limits and exception handling alone do not contain the allocation.
Microsandbox Security Update Addresses 1 Vulnerability
Microsandbox before 0.5.10 can expose host-side secrets in process arguments to local users or co-resident processes. Upgrade affected runtimes, replace running sandboxes and assess credential rotation; patching does not revoke previously exposed secrets.
CKAN MCP Server 0.4.108 Addresses an SSRF Validation Bypass
CKAN MCP Server can reach internal services through attacker-controlled DNS names. The advisory lists 0.4.108 as patched; update self-hosted deployments and restrict allowed destinations without treating the version claim as independently tested containment.
Sync-in Server Updates Fix 2FA, ReDoS, and Login Enumeration Flaws
Sync-in Server 2.4.1 addresses MFA weaknesses, costly sync-filter processing and login-timing enumeration. Update beyond 2.4.0, then check token enforcement, registration lockout and sync behavior with approved accounts.
NotebookLM MCP 2.0.3 Restricts Vault File Writes
NotebookLM MCP 2.0.3 sanitizes vault filenames, but directory containment remains opt-in. Upgrade affected servers, configure NOTEBOOKLM_VAULT_ROOT in the running process, and restrict its filesystem permissions; updating alone does not contain writes.
Erlang/OTP Updates Fix TLS Authentication and Denial-of-Service Flaws
Erlang/OTP fixes affect separate ssl, asn1 and ssh applications. Inventory the runtime actually loaded by each service and update its supported branch; restricting TLS to 1.2 only addresses the TLS authentication issue temporarily.
Open VSX 1.2.0 Blocks Marketplace Cache Poisoning
Open VSX cache poisoning requires trusted attacker-controlled forwarded-host data and an unpopulated cache entry. Check the deployed server or container version and those conditions, then apply the supported update containing the 1.2.0 fix.
nvm 0.40.8 Blocks Malicious .nvmrc Path Traversal
A malicious repository-controlled .nvmrc can make vulnerable nvm read outside its alias directory and disclose local files. Update the active nvm installation and review developer, CI and shell-hook workflows that process untrusted repositories.
Elixir Mint 1.10.1 Fixes HTTP Response-Smuggling Parsing Flaw
Mint 1.10.1 fixes CVE-2026-82672, an HTTP response-framing flaw. Validate affected dependencies and pooled intermediary paths, then update.