Network Security & Monitoring
WatchGuard Fireware Updates Fix 18 New Security CVEs
WatchGuard Fireware updates fix 18 CVEs. Match platform and branch, upgrade supported builds, validate services, and retain evidence.
WatchGuard AP 3.4.8 Fixes Three Access and Command-Injection Vulnerabilities
WatchGuard AP 3.4.8 fixes internal-API access and command-injection flaws plus an administrator-only diagnostic CLI issue. Update access-point firmware while preserving coverage and management access; this is not a Firebox advisory.
ManageEngine Applications Manager Updates Address Six Vulnerabilities
ManageEngine Applications Manager fixes span Enterprise synchronization, plugin identity, monitor scope and an installer-exposed cloud key. Match the supported build track and review unauthorized changes; updating does not establish that the old cloud key was revoked.
ManageEngine ITOM Updates Address Eleven Vulnerabilities
ManageEngine ITOM fixes span editions, plugins, roles and disjoint release intervals. Inventory Central/Probe and Firewall Analyzer exposure, follow each applicable upgrade matrix, and review unauthorized changes rather than assuming a higher build resolves every issue.
Nautobot Security Update Addresses 2 Vulnerabilities
Nautobot fixes stored script injection in form help text and a separate approval-workflow authorization bypass. Match the installed branch, review content-editing and approval permissions, and validate both browser rendering and scheduled-job approval boundaries.
Nuclei Security Update Addresses 5 Vulnerabilities
Nuclei 3.10.0 fixes scanner-host code, file-access and conditional environment-disclosure flaws. Update engines and SDK consumers, stop untrusted template execution, and handle potentially exposed credentials separately from the upgrade.
Graylog Security Update Addresses 1 Vulnerability
Graylog editors can improperly transfer ownership of saved searches or dashboards, enabling deletion or loss of access. Update self-managed branches and test object permissions; Graylog reports its Cloud service already patched.
OpenCVE Security Update Addresses 1 Vulnerability
OpenCVE notification testing can let authorized users send server-side requests to internal services. Upgrade to 3.0.0 or later, review notification permissions and restrict egress while planning the supported major-version migration.
SolarWinds Observability 2026.2.3 Fixes Two Remote Code Execution Flaws
SolarWinds Observability Self-Hosted 2026.2.3 fixes two unauthenticated code-execution flaws with configuration-specific prerequisites. Obtain vendor guidance on the unnamed settings and communication mode, then update; default settings alone do not establish safety.
TR-CERT Warns of Critical SQL Injection in Unsupported KarelIPS
Unsupported KarelIPS has an unauthenticated blind SQL-injection flaw with no fixed release identified. Restrict exposure, preserve relevant evidence and plan retirement or replacement; compensating controls do not repair the defect.