Sign in Subscribe
Catalog Updates

Elestio Catalog Updates: 142 New Releases This Week (November 1-7, 2026)

Michael Soto

• 4 min read
Share
Elestio Catalog Updates: 142 New Releases This Week (November 1-7, 2026)

142 stable releases landed across 52 services in the Elestio catalogue between 1 and 7 November. Nine of them fix security issues, one identity provider shipped more CVE fixes in a single patch than most projects do in a year, and two projects went to a new major version.

Start with the security section. Everything else can wait for Monday.

Security Alerts

Keycloak 26.8.2 (5 November) lists 33 CVE fixes. The worst include a SAML redirect signature bypass allowing broker login as any user (CVE-2026-117691), account takeover through an authentication race (CVE-2026-103112), stored XSS on the login page (CVE-2026-107889), and an unauthenticated request that can kill the JVM through the SAML 1.1 parser (CVE-2026-110931). If anything in your stack signs in through Keycloak, this is the one to do first.

Mastodon patched four branches on 3 November: 4.7.5, 4.6.11, 4.5.21 and 4.4.28. 4.7.5 fixes a password authentication bypass for inactive accounts, and all four fix a denial of service through JSON-LD compaction. If your reverse proxy uses the Forwarded header, read the notes: it no longer takes precedence over X-Forwarded-For, and you should update the provided nginx.conf.

Vaultwarden 1.37.5 (1 November) fixes advisories in emergency access and website icons, both rated medium. The project strongly advises updating.

Mattermost shipped 12.0.2, 11.11.4, 11.10.5 and the 11.7.15 extended support release on 5 November, with fixes rated up to High.

Open WebUI 0.13.0 (3 November) contains security fixes that the project will detail later. It recommends updating all deployments as soon as possible.

Huginn released two security updates. v2026.11.05 fixes stored XSS in shared OAuth service names and Agent descriptions and adds CSRF protection to admin user switching. v2026.11.05.2 then moved to the patched Rails 8.1.4.1.

Wekan 13.00 (7 November) fixes "CreateBleed": the "only admins can create boards" setting is now enforced on every path, including the REST API, imports, copies and clones, not just the Add Board form.

Meilisearch 1.56.1 and 1.55.1 (2 November) fix the memory use and runtime of very long filters.

Supabase self-hosted v0.8.4 (5 November) carries security fixes for Storage and Functions.

Databases

AI and GPU

Development

Hosting and Infrastructure

Applications

What Stood Out This Week

Keycloak's 33 CVEs in one patch. Several entries carry bug bounty references, which suggests a research programme clearing its backlog at once. Expect more large batches like this as finding bugs gets cheaper.

Immich apologised for telemetry it didn't know it was sending. v3.3.6 disables telemetry that the onnxruntime dependency had switched on by default, which sent anonymous metrics to Microsoft from the machine learning container. Credit to the team for saying so plainly. It's the privacy version of a story we keep telling: your dependencies make decisions your app never made.

Brotli is still working its way through. Rocket.Chat and Hasura both shipped releases this week to pick up the Brotli fix for CVE-2026-111497, two weeks after it reached CISA's exploited list. Long tails are normal, and this is what one looks like.

Drupal shortened its security window. A public service announcement on 2 November cut security support for core minor versions to eight months. If you stay a minor or two behind on purpose, your margin just got smaller.

Everything above is available as a one-click managed deployment in the Elestio catalogue, with automated updates, backups and monitoring. If you have automatic updates enabled, the security releases in this list are already queued for you.

Thanks for reading ❤️ See you next Sunday 👋

Sign up for more like this.

Enter your email
Subscribe