# Self Host Lab Self-hosting, homelab & media server guides This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Nextcloud Hub 26 Summer Released, Euro-Office Desktop App Coming Soon DevFeed: [Nextcloud Hub 26 Summer Released, Euro-Office Desktop App Coming Soon]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-16T18:32:34Z Content type: release Language: en Sources: [Self Host Lab]() Topics: [Nextcloud](), [Open Source](), [Self-hosted](), [microsoft 365]() Tags: [collaboration](), [desktop](), [feature](), [microsoft-365](), [news](), [office](), [open-source](), [release](), [self-hosted]() ### AI overview Nextcloud Hub 26 Summer is live, with the Euro-Office desktop app announced for release in the coming weeks. The update also includes faster browser-based Office features and partner-contributed tools for teams, calendar resource booking, and Tables. ### Source excerpt Nextcloud's Hub 26 Summer is live today, headlined by a new Euro-Office desktop app arriving in the coming weeks, plus features co-built with partners including IONOS, SURF, and the German state of Schleswig-Holstein. ## n8n Patches 16 Security Vulnerabilities, 12 Rated High Severity DevFeed: [n8n Patches 16 Security Vulnerabilities, 12 Rated High Severity]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-16T18:31:20Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [n8n](), [Vulnerabilities](), [patches](), [Security](), [Self-hosted]() Tags: [automation](), [n8n](), [news](), [patches](), [security](), [security-vulnerabilities](), [self-hosted](), [update](), [vulnerabilities]() ### AI overview n8n published a bi-weekly security update disclosing 16 fixed advisories: 12 rated High severity and 4 rated Medium. The article highlights an unauthenticated NoSQL injection in the MongoDB Chat Memory node that can disclose chat history across sessions, along with five High-severity credential-handling advisories. ### Source excerpt n8n, the self-hosted workflow automation platform covered regularly on this site, published its bi-weekly security update on September 16, 2026. The bulletin, posted on the official n8n Community forum by a member of the n8n security team, discloses 16 advisories fixed since the previous update on September 2: 12 rated High severity and 4 rated [...] ## Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw DevFeed: [Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-14T06:55:25Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Security](), [vulnerability](), [Monitoring](), [configuration]() Tags: [2026](), [cve](), [dependency](), [monitoring](), [monitoring-news](), [news](), [security](), [update](), [uptime-kuma-2-5-4](), [vulnerability]() ### AI overview Uptime Kuma 2.5.4 fixes a critical JSONata vulnerability that could enable arbitrary code execution on the monitor host, along with a second denial-of-service issue. The release updates jsonata to 2.2.2 and also adds an SFTP monitor type and three notification providers. ### Source excerpt Uptime Kuma 2.5.4 patches a critical-rated code execution flaw in the JSONata library (CVE-2026-77415, CVSS 9.3) plus a second denial-of-service fix, and adds an SFTP monitor type and three new notification providers. Here's what the flaw actually requires to exploit, and how to update. ## Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE DevFeed: [Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-12T06:40:18Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [vulnerability](), [releases](), [Security](), [Template](), [Authorization](), [API](), [Git]() Tags: [api](), [docker-containers](), [docker-containers-news](), [forgejo](), [git](), [news](), [release](), [security](), [self-hosted](), [update](), [vulnerability]() ### AI overview Forgejo 16.0.4 and 15.0.8 fix a critical remote code execution vulnerability in repository-template creation, along with an API authorization bypass. The article explains how malicious template variables could restore a .git directory with executable hooks and urges affected self-hosted instances to update. ### Source excerpt Forgejo 16.0.4 and 15.0.8 patch a critical remote code execution vulnerability in repository templates, tracked as CVE-2026-89094 with a CVSS score of 9.9, plus a narrower API permission bypass. Any instance on 16.0.3 or earlier, or 15.0.7 or earlier on the LTS branch, is vulnerable. Here's what happened, why it matters, and how to update. ## Jellyfin 12.0 Is Out: What Breaks Before You Upgrade DevFeed: [Jellyfin 12.0 Is Out: What Breaks Before You Upgrade]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-08T06:32:10Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Database Migration](), [Database](), [Security](), [Server]() Tags: [article](), [backup](), [bug](), [data](), [database](), [jellyfin](), [jellyfin-12-0-is](), [jellyfin-news](), [news](), [release](), [security](), [server](), [update]() ### AI overview Jellyfin 12.0 introduces a new versioning scheme and a database rewrite that makes upgrading a consequential operation. Users must meet the supported upgrade path, back up and verify restoration of their configuration and database, complete a full library scan, remove or recompile third-party plugins, and account for removed legacy API and login support. ### Source excerpt Jellyfin 12.0 shipped on September 7, 2026, after months stuck in release candidate limbo. It's the biggest Jellyfin release since the project forked from Emby in 2018, and the version number itself is the first clue: this build reports as 12.0, not 10.12.0. That's not a typo. Jellyfin has dropped the "10" major prefix that led its version numbers since the fork. ## n8n Patches 18 Security Vulnerabilities in Bi-Weekly Update DevFeed: [n8n Patches 18 Security Vulnerabilities in Bi-Weekly Update]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-06T06:31:02Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Security](), [Vulnerabilities](), [workflow automation](), [Automation](), [Code](), [Homelab](), [OAuth](), [Regular expression](), [data](), [Git](), [JSON](), [OpenAI]() Tags: [article](), [automation](), [code](), [data](), [external](), [git](), [json](), [n8n](), [n8n-patches-18](), [news](), [oauth](), [openai](), [security](), [self-hosted](), [update](), [vulnerabilities](), [workflow](), [workflow-automation]() ### AI overview n8n's September 2, 2026 bi-weekly security update fixes 18 vulnerabilities: five high-severity and thirteen medium-severity issues. The most serious flaws are two expression-sandbox escapes that can enable arbitrary code execution on self-hosted servers. Other high-severity fixes address denial-of-service, ReDoS, and an OpenAI model-search domain-restriction bypass. ### Source excerpt Read this article in French: n8n corrige 18 failles de sécurité dans sa mise à jour bi-hebdomadaire n8n is one of the most widely deployed self-hosted workflow automation platforms, often described as the fair-code alternative to Zapier and Make. People use it to move data between apps, trigger scripts on a schedule, and glue together [...] ## Plex Urges Users to Update After Undisclosed Security Fixes in 1.43.3 DevFeed: [Plex Urges Users to Update After Undisclosed Security Fixes in 1.43.3]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-05T06:33:40Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [Security](), [Vulnerabilities](), [Server](), [Docker]() Tags: [announcement](), [docker](), [media](), [nas](), [news](), [news-plex](), [pc](), [plex](), [plex-urges-users](), [security](), [server](), [update](), [updates](), [vulnerabilities]() ### AI overview Plex released Media Server 1.43.3 and Plex Desktop 1.115.0 to address undisclosed security issues affecting Media Server 1.43.2 and earlier. CVE identifiers and technical details were not public at the time of writing, but Plex urges all server owners and Desktop users to update promptly. ### Source excerpt Plex has pushed out Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to patch what the company describes only as "a number of security issues." If you run a Plex server on a NAS, a home PC, or in Docker, this is one of those updates worth doing today rather than filing away for later. [...] ## Home Assistant 2026.9 Adds Security Alerts and Removes the VLC Integration DevFeed: [Home Assistant 2026.9 Adds Security Alerts and Removes the VLC Integration]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-03T06:30:38Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Home Assistant](), [dashboards](), [Security](), [Accessibility](), [VLC]() Tags: [accessibility](), [home-assistant-2026-9](), [home-automation](), [home-automation-news](), [integrations](), [news](), [release](), [security](), [september-2026](), [update]() ### AI overview Home Assistant 2026.9 is a stable release that adds conditional security alerts, favorites, shared filtering for History and Activity, accessibility improvements for charts, and a shared-bus Modbus foundation. The release also includes breaking changes, including removal of the VLC integration. ### Source excerpt Home Assistant 2026.9, "There's room on this bus," is now the stable release. The Security dashboard gains an Active alerts section that only appears when something needs attention, History and Activity share a new Sources panel, and Modbus gets a shared-bus rework. Several breaking changes deserve a read first, starting with the removal of the VLC integration. ## Gitea v1.27.3 Ships 18 Security Hardening Fixes DevFeed: [Gitea v1.27.3 Ships 18 Security Hardening Fixes]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-01T06:31:36Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Gitea](), [Security](), [Authorization](), [API](), [Vulnerabilities](), [Pull Request](), [GitHub](), [GitLab](), [Maven](), [Swift]() Tags: [api](), [changelog](), [code](), [git](), [gitea-v1-27-3-ships](), [github](), [maintainers](), [network-security](), [network-security-news](), [news](), [pull-requests](), [release](), [security](), [vulnerabilities]() ### AI overview Gitea v1.27.3 introduces 18 security hardening fixes focused primarily on access control. The release narrows package and API-token access, restricts repository and attachment exposure, strengthens pull-request and artifact trust boundaries, and limits several migration and metadata inputs. It follows earlier Gitea releases that addressed numbered vulnerabilities, but these fixes do not carry dedicated CVE identifiers. ### Source excerpt Gitea v1.27.3 landed August 29, 2026 with an unusually long SECURITY section: 18 separate access-control hardening fixes, none carrying a CVE identifier. The changes tighten package API scope, attachment paths, repository enumeration, and more. It's the third Gitea security story here in three weeks, following the CVE-2026-59774/60004 patches and CISA's active-exploitation confirmation. Update on your normal schedule. ## Paperless-ngx 3.1.0 Adds AI Workflow Actions and Document Versioning DevFeed: [Paperless-ngx 3.1.0 Adds AI Workflow Actions and Document Versioning]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-08-31T06:39:07Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [Artificial Intelligence](), [OpenID connect (OIDC)](), [Compression](), [Open Source](), [Authorization]() Tags: [ai](), [bug](), [changelog](), [compression](), [identity](), [news](), [news-personal-cloud](), [ocr](), [open-source](), [paperless-ngx](), [personal-cloud](), [release](), [self-hosted](), [updates](), [workflow]() ### AI overview Paperless-ngx 3.1.0 adds automatic AI-based workflow classification, per-document remote OCR selection, OIDC group synchronization, document versioning, configurable ZIP compression, and smaller fixes. ### Source excerpt Paperless-ngx 3.1.0 landed on August 27, 2026, adding a workflow action that applies AI-generated tag and correspondent suggestions automatically, per-document selective remote OCR, OIDC group sync mapping identity-provider groups to superuser and staff roles, a new versioning system for merging documents into successive versions, configurable ZIP export compression, and numerous smaller UI bug fixes sitewide. ## BookStack Security Update Patches Critical RCE Flaw in v26.05.4 DevFeed: [BookStack Security Update Patches Critical RCE Flaw in v26.05.4]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-08-31T06:36:25Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [Vulnerabilities](), [Security](), [Authorization](), [Open Source]() Tags: [bookstack-security](), [news](), [news-personal-cloud](), [open-source](), [personal-cloud](), [security](), [self-hosted](), [update](), [vulnerabilities]() ### AI overview BookStack v26.05.4 is a dedicated security release that fixes four vulnerabilities, including a critical authenticated remote code execution flaw involving crafted ZIP imports, an XSS issue, and two draft-page permission bypasses. The article recommends updating and restricting import permissions if an immediate update is not possible. ### Source excerpt BookStack v26.05.4, released August 24, 2026, is a dedicated security update patching four vulnerabilities: a critical RCE (CVE-2026-82450) exploitable through crafted ZIP imports, an XSS flaw in drawing endpoints, and two permission bypasses affecting draft pages. The BookStack team recommends updating everyone, but especially instances where untrusted users hold general or edit-level access to content. ## Open WebUI v0.11.1 Adds Human-in-the-Loop Tool Approval DevFeed: [Open WebUI v0.11.1 Adds Human-in-the-Loop Tool Approval]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-08-30T06:34:36Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Artificial Intelligence](), [Terminal](), [Homelab]() Tags: [agentic](), [ai](), [bugs](), [homelab](), [news](), [news-self-hosted-ai](), [open-webui](), [release](), [self-hosted](), [self-hosted-ai]() ### AI overview Open WebUI v0.11.1 adds human-in-the-loop approval for selected AI tool calls, allowing users to review actions before execution. The release also fixes terminal-attached chat failures and two calendar timezone-related bugs. ### Source excerpt Open WebUI v0.11.1 adds human-in-the-loop tool approval, letting you manually confirm certain tool calls before the AI runs them. The release also fixes chats with an attached personal terminal, plus two calendar bugs: new events now default to today's date, and recurring events finally display at the time you actually configured, not a miscalculated one. ## Gitea RCE Flaw Now Under Active Exploitation, CISA Confirms DevFeed: [Gitea RCE Flaw Now Under Active Exploitation, CISA Confirms]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-08-29T06:33:49Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [Gitea](), [Vulnerabilities](), [Security](), [incident](), [Cryptocurrency](), [Docker Container]() Tags: [cryptocurrency](), [docker-container](), [gitea-rce](), [hosting](), [incident](), [network-security](), [network-security-news](), [news](), [security](), [self-hosted](), [vulnerabilities]() ### AI overview CISA confirmed that the critical Gitea vulnerability CVE-2026-60004 is being actively exploited and added it to the Known Exploited Vulnerabilities catalog. The article explains the exploit through Gitea's diffpatch API, which can enable arbitrary code execution, and describes a documented compromise of an outdated self-hosted instance that led to cryptocurrency mining inside a Docker container. ### Source excerpt CISA has added CVE-2026-60004, the critical Gitea RCE flaw patched in version 1.27.1, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Help Net Security documented a real compromise: an outdated instance with open registration hit by an automated scanner, ending in a cryptocurrency-mining payload. Here is what changed and how to patch.