Server

Opto 22's groov View software and firmware versions prior to R4.5e and 4.0.3 respectively have a vulnerability exposing sensitive metadata such as API keys. The company has released patches and CISA advises network isolation and VPN use to mitigate potential exploitation risks.

Itential’s MCP server links conversational AI with enterprise automation to ensure governed, precise infrastructure operations.

AVEVA has reported a vulnerability in its Application Server Immutable Deployment Environment that could allow attackers to exploit improper HTML script neutralization. Users are advised to update to secure versions and implement defensive measures to minimize risk.

General Industrial Controls' Lynx+ Gateway faces multiple vulnerabilities, including weak password requirements and missing authentication. These issues could lead to unauthorized access and denial of service. Users are advised to enhance security measures and follow CISA's recommendations to mitigate risks.

Automated Logic's WebCTRL Premium Server has vulnerabilities including Open Redirect and Cross-Site Scripting (XSS). Users are advised to upgrade to version 9.0 as previous versions are affected. CISA recommends security practices to mitigate potential exploitation.

CAST has released the Model Context Protocol (MCP) server for CAST Imaging, enabling AI to access architectural context necessary for understanding and modifying large enterprise applications. This development allows for quicker task completion and practical modernization efforts across various software frameworks.

Supermicro launched a 10U air-cooled server powered by AMD Instinct MI355X GPUs, enhancing performance for AI and inference workloads.

The post Secure Mediation & Translation: How Itential MCP Enables Controlled AI-Infrastructure Integration appeared first on Itential.

Hiawatha, an open-source web server, has multiple vulnerabilities affecting versions 8.5 to 11.7, requiring updated releases for remediation.

LangChainGo's CVE-2025-9556 vulnerability allows arbitrary file read via the Gonja template engine, enabling SSTI attacks.

A vulnerability in CORS headers across several browsers allows manipulation of policies, enabling attackers to send unauthorized requests. Users should ensure their browsers are updated with the latest patches.

Email header syntax can be exploited to bypass SPF, DKIM, and DMARC, allowing attackers to send spoofed messages from trusted addresses.