Vendor Security Advisory
Ubiquiti UniFi Gateway Updates Fix Six Denial-of-Service Flaws
Six UniFi gateway flaws can cause network-triggered denial of service. Match firmware to the exact device model, distinguish Express from Express 7, and prepare configuration backups and recovery access before updating.
Adobe InDesign Update Addresses 2 Vulnerabilities
Adobe InDesign updates fix two user-interaction-dependent flaws that can crash the application on Windows and macOS. Install 21.6 or 20.5.5 for the appropriate branch; the bulletin does not describe code execution.
RTI Connext Updates Address Nineteen Vulnerabilities
RTI Connext Professional and AUTOSAR Toolkit updates cover nineteen vulnerabilities with different component, architecture and configuration requirements. Match each deployed branch to its supported patch and plan rebuild, redeployment and interoperability checks.
Arista Warns of Exploited VeloCloud Orchestrator RCE
Arista reports active exploitation of the VeloCloud Orchestrator flaw and says hosted services were patched. On-premises operators should restrict management access, preserve evidence and obtain the branch-specific fix, including guidance where no fix is listed.
SAP Fiori Launchpad Update Addresses Information Disclosure
A malicious link can expose information from an authenticated SAP Fiori Launchpad session without the attacker having an account. Record SAP_UI and SAP_BASIS levels, then obtain the applicable correction and prerequisites through authorized SAP support.
NVIDIA Infrastructure Controller 2.0 Fixes Fourteen Flaws
NVIDIA Infrastructure Controller for Linux needs the supported controller update addressing fourteen vulnerabilities. Inventory the deployed release, update through NVIDIA's infra-controller repository, and confirm the replacement software is actually running.
NVIDIA NeMo Speech 3.0 Fixes Five Code Execution Flaws
NeMo Speech updates address five vulnerabilities across platforms. Inventory environments and external datasets, model configurations and serialized tokenizer inputs, update the runtime, and redeploy jobs or services still using the old environment.
OpenStack Octavia Fixes HAProxy Configuration Injection
An authenticated load-balancer owner can inject HAProxy configuration through Octavia's Amphora provider and reach root on the amphora. Check provider and branch, then verify the supported package contains both fixes; other provider drivers are outside this scope.
Thinkst Patches Canary Redis Denial of Service
The Canary Redis denial-of-service flaw applies only when Redis is enabled. Match the Canary platform to its fix and verify installation in the Console; Docker deployments require a new image and redeployment.
Dassault Systèmes Warns of Tuleap Command Injection
Affected Tuleap Enterprise builds permit operating-system command injection, but the public notice supplies no exact replacement build. Record the complete installed build and obtain the supported fix and upgrade path from the vendor.