Vendor CNA Record
OpenPLC Runtime v4 Replaces Vulnerable End-of-Life v3
End-of-life OpenPLC Runtime v3 has a web-interface script-injection flaw that can affect operator sessions. Limit exposure and plan an operations-approved v4 migration, validating programs, I/O and safe-state recovery offline before cutover.
lwIP Fixes MQTT and API Memory-Corruption Vulnerabilities
lwIP MQTT and API flaws have different network scopes and separate fixes. Identify affected embedded devices and obtain supported firmware containing the applicable commits; updating a source checkout alone does not remediate deployed equipment.
HP Support Assistant 9.55.10.0 Fixes Local Privilege Escalation
HP Support Assistant before 9.55.10.0 has a local privilege-escalation flaw involving insufficient access controls. Update affected endpoints through HP's supported channel and verify installed versions; this is not an unauthenticated network attack.
F5 BIG-IP APM Hotfixes Address Critical OAuth Vulnerability
BIG-IP APM OAuth Authorization Server configurations face an exploited unauthenticated code-execution flaw. Preserve evidence, obtain F5's supported mitigation and hotfix, and keep forensic triage separate from successful patch installation.
Mattermost Updates Bound Bulk Reactions Requests
An authenticated Mattermost user can submit an unbounded bulk-reactions post-ID array and overload the database. Update the installed maintenance stream, prepare database recovery, and verify every application node leaves the affected range.
ManageEngine ADSelfService Plus 7001 Fixes RCE and Authentication Bypass
ADSelfService Plus fixes separate Windows logon-client SYSTEM execution and unauthenticated REST API bypass. Update the server and verify vendor-supported GINA client rollout; a server build check alone does not establish that affected endpoints changed.
Temporal Discloses Eight Authorization and Availability Flaws
Temporal's eight issues span namespace authorization, callbacks, worker commands and resource exhaustion. Match each version and configuration prerequisite, preserve existing workflow settings, and apply the corresponding Server or library fix rather than one assumed universal update.
Canva Fixes HarmonyOS Mobile Session Exposure
The Canva HarmonyOS flaw can expose session headers when an attacker controls the privileged WebView. Update affected HarmonyOS installations and review session activity; the notice does not extend this finding to other Canva platforms.