Sign in Subscribe
Catalog Updates

Elestio Catalog Updates: 44 New Releases This Week (August 2-8, 2026)

Michael Soto

• 4 min read
Share
Elestio Catalog Updates: 44 New Releases This Week (August 2-8, 2026)

Busy week across the catalog. Forty-four services shipped stable releases between August 2 and 8, and three of them are security updates you'll want to apply before anything else. Milvus also crossed a major version line, and NocoDB shipped the biggest single feature of the week.

Security Alerts

WordPress 7.0.3 (Aug 6) fixes 12 vulnerabilities, including CVE-2026-64638, a pre-auth reflected XSS on the login screen with potential for PHP code execution. There's also a multisite privilege escalation and several stored XSS flaws. Backports landed simultaneously for 6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10 and 6.1.11, so there's a patch for whatever branch you're on. Update today.

Keycloak 26.7.1 (Aug 5) resolves five CVEs. CVE-2026-4629 is privilege escalation via hardcoded role mapper injection in manage-clients. CVE-2026-9793 lets a JWE request object bypass requestObjectSignatureAlg enforcement. The remaining three (CVE-2026-14209, CVE-2026-14614, CVE-2026-14615) are all Fine-Grained Admin Permissions bypasses, so if you run FGAP v2 this one is aimed squarely at you.

Vault 2.0.4 (Aug 4) patches a privilege escalation where a denied_parameters constraint on the policies field could be bypassed by submitting a mixed-case policy name. Vault now normalizes to lowercase before evaluating constraints. Note the breaking change too: gnupg, openssl and procps were removed from the UBI container images.

Databases

  • Milvus 3.0.0 (published Aug 4, notes dated Jul 29) completes the lake-native architecture from the 3.0 beta: External Collection covers more lakehouse workflows, schemas support online add, backfill and drop, the sparse index is rebuilt around SINDI, and Woodpecker runs standalone. 2.6.22 also shipped Aug 5 for anyone staying put.
  • OpenSearch 3.8.0 (Aug 5) adds an API to modify a data stream's backing indices, a multivalue_doc_count aggregation, and pull-based ingestion from Hive tables.
  • ClickHouse 26.7.3.19 (Aug 6), with 26.6.2, 26.3.17-lts and 25.8.29-lts patched the same week.
  • Apache Cassandra 5.0.9 (Aug 7), alongside 4.1.12 and 4.0.21.
  • Weaviate 1.38.9 (Aug 6) fixes backup chunk integrity and async replication.
  • Neo4j 2026.07.1 (Aug 6), plus 5.26.29 on the LTS line.
  • InfluxDB 3.11.1 (Aug 6).
  • TimescaleDB 2.29.1 (Aug 4).

AI and GPU

  • Ollama 0.32.6 (Aug 5) makes Qwen3.5 faster on Apple GPUs by using the model's MTP head for speculative decoding automatically. The bigger deal for anyone building against it: /v1/chat/completions streaming now matches OpenAI's wire format properly, with role only on the first chunk, finish_reason on its own chunk, and usage in a separate chunk.
  • Langflow 1.11.3 (Aug 8) is a test-stability release ahead of the 1.12 line.

Development

Hosting and Infrastructure

Applications

What Stood Out This Week

Keycloak's FGAP problem. Three of the five CVEs are Fine-Grained Admin Permissions bypasses. FGAP v2 is relatively new, and a cluster of bypasses in one release suggests the feature is still settling. If you adopted it early to delegate admin rights, audit what those delegated admins can actually reach.

Milvus 3.0.0 is a real architecture shift. Lake-native storage, standalone Woodpecker, online schema changes. This isn't a version bump you take on a Friday afternoon. Read the migration notes properly.

Qdrant's TurboQuant 4-bit. Storing only 4-bit quantized vectors and dropping the originals is a serious disk saving for large collections. The trade-off is recall, so benchmark against your own data before committing.

WordPress patched ten branches at once. Nine backports alongside 7.0.3 tells you the maintainers considered this urgent enough to reach installs running four-year-old majors. Treat it accordingly.

All of these run as managed deployments on Elestio, where updates, backups and SSL are handled for you. VMs start at $16/month for the entry NETCUP config (2 vCPU, 4 GB RAM, 60 GB NVMe).

Thanks for reading ❤️ See you next Sunday 👋

Sign up for more like this.

Enter your email
Subscribe