Weekly field logNo. 2026-W43

Self-hosted Upgrade Notes

What breaks if you update.

October 15–22, 2026

14 of 25 apps published a GitHub release in this 7-day window. 3 releases mention a breaking change, a migration, a deprecation, or a step you do by hand. CISA added 4 known exploited vulnerabilities matching Plex. Flags are a keyword scan. The source link is the record.

Permanent link for this issue

01 — Security

Added to CISA's exploited list

CISA has evidence these are being used, not just that a CVE number exists. Catalog 2026.10.21.

The soonest due date in this batch is October 23, 2026.

Plex KEV ×4

Plex · Media Server · added October 20, 2026

Plex Media Server does not publish GitHub releases. plexinc/pms-docker is the Docker packaging repository, not the server changelog, so this pipeline does not read it. KEV matching still runs. Compare the version you have with Plex's own announcements.

Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • CVE-2026-96656 Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Due October 23, 2026 CISA note
  • CVE-2026-96655 Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. Due November 3, 2026 CISA note
  • CVE-2026-96654 Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. Due October 23, 2026 CISA note
  • CVE-2026-96652 Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Due November 3, 2026 CISA note

02 — Upgrades

Read before you update

Each mark is a sentence in the release notes. Open the source before you pull the image.

Portainer 2.45.3

Breaking Manual step

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Portainer no longer trusts TLS certificates issued by eMudhra (emSign), following the compromise of eight eMudhra intermediate CAs (CVE-2026-111943).

Check your services before upgrading.

Release notes

n8n n8n@2.45.0 Pre-release

Migration

AI Agent Node: Replay Anthropic thinking turns with their tool arguments (#41241) (ea98bd0)

core: Implement automated migrations for removed nodes (#40877) (739c59e)

Release notes

Pi-hole v6.5

Migration Deprecation

This release fixes the following security advisories (credit to the reporters named):

Existing databases are migrated to schema version 21 on update.

Remove the deprecated arpflush command in favour of networkflush.

Release notes

03 — Shipped

Other releases

Other releases in this window
AppVersionPublished
n8nn8n@1.123.86
n8nbeta Pre-release
Notes

core: Read type availability policies from memory at enforcement points (#41621) (6433596)

n8nn8n@2.45.2 Pre-release
Notes

core: Read type availability policies from memory at enforcement points (#41621) (6433596)

n8nstable
Notes

Postgres Node: Prevent global pgtypes overwrite (#41667) (654315e)

n8nn8n@2.44.6
Notes

Postgres Node: Prevent global pgtypes overwrite (#41667) (654315e)

Stirling-PDFv3.2.1
Notes

Smaller release with some nice viewer and editor improvements and bug fixes for annotation and compression

Immichv3.3.5
Notes

> [!CAUTION] > This version contains a fix for today's CA compromise ( as well as some nodejs security patches.

Authentikversion/2026.8.5
Notes

endpoints: fix MultipleObjectsReturned (cherry-pick #26971 to version-2026.8) (#26972)

n8nn8n@2.45.1 Pre-release
Notes

core: Claim an idle worker's next queue job and its lock in one step (#41558) (5f0b562)

Authentikversion/2026.5.8
Notes

ci: remove the Google Chrome apt source in setup (cherry-pick #25990 to version-2026.5) by @authentik-cherry-pick[bot] in

n8nn8n@2.44.5
Notes

core: Key queue job outcomes by job on shutdown resume (#41404) (1f074d4)

Syncthingv2.1.7
Notes

fix(sqlite): avoid early garbage collection of deleted recv-enc files by @calmh in

Syncthingv2.1.7-rc.4 Pre-release
Notes

Devices and folders can now be grouped in the GUI by setting the new

Sonarrv5.0.0.2742 Pre-release
Notes

Translations update from Servarr Weblate by @ServarrAdmin in

Traefikv3.7.16
Notes

[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url (#14091 @juliens)

Traefikv2.11.60
Notes

[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth (#14084 @juliens)

Immichv3.3.4
Notes

Turns out the last people performance fix wasn't quite there for some people.

Paperless-ngxv3.3.3
Notes

Fix: fix global search input layout shifting @shamoon (#14491)

n8nn8n@2.44.4
Notes

core: Reuse connections in the log streaming webhook destination (#41281) (b79afe2)

n8nn8n@2.43.8
Notes

core: Turn off expression spans by default (#41310) (e88162a)

Sonarrv5.0.0.2701 Pre-release
Notes

Translations update from Servarr Weblate by @ServarrAdmin in

Giteav28.2.0
Notes

(oauth) Pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801)

Syncthingv2.1.7-rc.3 Pre-release
Notes

Devices and folders can now be grouped in the GUI by setting the new

Mealiev3.29.0
Notes

Another big update packed with hotly-requested features and tons of bug fixes.

Sonarrv5.0.0.2668 Pre-release
Notes

Validate restored database and keep previous DB until after restore by @IonBazan in

Home Assistant2026.10.2
Notes

Fix IndexError on out-of-range heater levels in Tesla Fleet ([@sebr] - [#178049]) ([teslafleet docs])

n8nn8n@2.43.7
Notes

core: Suspend in-flight production executions at worker shutdown (#40944) (5863179)

n8nn8n@2.44.3 Pre-release
Notes

core: Keep Observer detail lines instead of discarding the response (#41157) (c09e0a9)

Paperless-ngxv3.3.2
Notes

> [!NOTE] > This release addresses a security issue (GHSA-c8f3-pqr2-rr24) and is recommended for all users.

Sonarrv5.0.0.2635 Pre-release
Notes

Translations update from Servarr Weblate by @ServarrAdmin in

Frigatev0.18.2
Notes

This is a maintenance release for Frigate 0.18 that includes some security fixes.

Stirling-PDFv3.2.0
Notes

The old multi-tool has been replaced by a completely redesigned Page Editor.

04 — Quiet

No GitHub release this week

Plex has no GitHub releases to scan.

05 — Still listed

Already on the KEV catalog

These were not added this week. They are still in the catalog.